Renn F c0c5838baa fix(bash-guard): close scheme-less curl bypass ...

Previous regex used a greedy [^|]* and required at least one / before
the host, so 'curl roboco-orchestrator:8000/api' (no scheme, no slash)
slipped through. Split into two simpler checks: (a) line starts with
curl/wget/http/https/httpie, AND (b) line contains a forbidden host.
Probe-verified: scheme-ful, scheme-less, and protocol-relative forms
all denied; external URLs still allowed; GitHub-specific deny still
fires first.

2026-05-03 06:17:37 +02:00

..

__init__.py

fix(bash-guard): deny internal curl to orchestrator/localhost

2026-05-03 06:11:38 +02:00

test_bash_guard.py

fix(bash-guard): close scheme-less curl bypass

2026-05-03 06:17:37 +02:00