mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-04 08:25:55 +08:00
Alexander Watson
d7f1f8052d
Integrate Z3-based formal verification for sandbox policies as openshell.prover. Detects data exfiltration paths, write bypass attacks, L7 enforcement gaps, overpermissive methods, and privilege escalation via binary capability chains. Closes #699 Signed-off-by: Alexander Watson <zredlined@gmail.com>
19 lines
597 B
YAML
19 lines
597 B
YAML
binary: /usr/local/bin/node
|
|
description: "Node.js runtime — general-purpose JavaScript runtime"
|
|
protocols:
|
|
- name: http-programmatic
|
|
transport: https
|
|
description: "Node can construct arbitrary HTTP requests via fetch, axios, http module"
|
|
bypasses_l7: false
|
|
actions:
|
|
- { name: get, type: read }
|
|
- { name: post, type: write }
|
|
- { name: put, type: write }
|
|
- { name: delete, type: destructive }
|
|
spawns:
|
|
- /usr/bin/curl
|
|
- /usr/bin/git
|
|
can_exfiltrate: true
|
|
exfil_mechanism: "Construct arbitrary HTTP requests, spawn subprocesses"
|
|
can_construct_http: true
|