Package org.machanism.machai.gw.tools

Class CommandSecurityChecker

java.lang.Object
org.machanism.machai.gw.tools.CommandSecurityChecker
public class CommandSecurityChecker extends Object
Loads and evaluates command deny-list rules used by host-side command execution tools.

The checker reads one or more rule resources and evaluates an input command line against those rules. Each non-empty, non-comment line of a deny-list file must use one of the following formats:

  • REGEX:... – a Java regular expression; a match anywhere in the command is considered dangerous
  • KEYWORD:... – a case-insensitive substring match

This class provides a best-effort heuristic check. It should be used in addition to an allow-list and other host security controls. Instances load their rules during construction and are intended to be reused for subsequent command checks.

Author:
Viktor Tovstyi

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private final List<String>
    denyKeywords
    Case-insensitive keyword rules that reject matching command fragments.
    private static final String
    DENYLIST_PROP_NAME
    Configuration property whose value replaces or extends the loaded deny-list.
    private final List<Pattern>
    denyPatterns
    Compiled regular-expression rules that reject matching command fragments.
    private static final org.slf4j.Logger
    logger
    Logger used to report deny-list loading diagnostics.

  • Constructor Summary

    Constructors
    Constructor
    Description
    CommandSecurityChecker(Configurator configurator)
    Creates a new checker and loads deny-list rules from an operating-system specific classpath resource.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    denyCheck(String command)
    Checks whether the supplied command matches any deny-list rule.
    private void
    loadRules(String rulesString)
    Loads deny-list rules from the provided string.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • DENYLIST_PROP_NAME

      private static final String DENYLIST_PROP_NAME
      Configuration property whose value replaces or extends the loaded deny-list.

      When its value includes ActProcessor.SUPER_VALUE_PLACEHOLDER, that placeholder is replaced with the operating-system-specific default rules.

      See Also:

    • logger

      private static final org.slf4j.Logger logger
      Logger used to report deny-list loading diagnostics.

    • denyPatterns

      private final List<Pattern> denyPatterns
      Compiled regular-expression rules that reject matching command fragments.

    • denyKeywords

      private final List<String> denyKeywords
      Case-insensitive keyword rules that reject matching command fragments.

  • Constructor Details

    • CommandSecurityChecker

      public CommandSecurityChecker(Configurator configurator) throws IOException
      Creates a new checker and loads deny-list rules from an operating-system specific classpath resource.

      The following resources are expected to exist on the classpath:

      • denylist/windows.txt when running on Windows
      • denylist/unix.txt when running on a Unix-like OS

      In addition, the host may provide DENYLIST_PROP_NAME to extend or override the default deny-list.

      Parameters:
      configurator - configurator used to optionally extend the deny-list; must not be null
      Throws:
      IOException - if the selected resource cannot be found or read
      IllegalArgumentException - if no deny-list is defined for the current operating system
      NullPointerException - if configurator is null

  • Method Details

    • loadRules

      private void loadRules(String rulesString)
      Loads deny-list rules from the provided string.

      This method is intended for internal initialization. Each rule is trimmed before parsing; blank lines and lines beginning with # are ignored. A REGEX: rule is compiled as a Java regular expression, while a KEYWORD: rule is retained for case-insensitive substring matching. Rules with any other prefix are ignored.

      Empty strings and null values produce no rules and are logged as a warning. Existing rules are retained when this method is called again.

      Parameters:
      rulesString - string containing rule definitions, separated by line breaks; may be null
      Throws:
      PatternSyntaxException - if a REGEX: rule is not a valid Java regular expression

    • denyCheck

      public void denyCheck(String command) throws DenyException
      Checks whether the supplied command matches any deny-list rule.

      Regular-expression rules are evaluated first and match anywhere in the command. If none matches, keyword rules are evaluated as case-insensitive substring searches. If the command matches a rule, a DenyException is thrown containing a message identifying the matched rule; otherwise this method returns normally.

      Parameters:
      command - shell command to check; must not be null
      Throws:
      DenyException - if the command matches a deny-list rule
      NullPointerException - if command is null