security: compound command permission escalation — single allowed segment grants auto-allow to entire chain

[vika2603]

Summary

In src/hooks/permissions.rs, check_command_with_rules uses an any_allow flag
for compound commands. If any single segment matches an allow rule, the entire
compound command receives PermissionVerdict::Allow — even when other segments
have no matching allow rule and should default to ask.

Reproduction

Given ~/.claude/settings.json:

{
  "permissions": {
    "allow": ["Bash(git status *)", "Bash(git status)", "Bash(cargo *)"]
  }
}

$ rtk rewrite "git add ."                    # exit 3 (ask) — correct
$ rtk rewrite "git status && git add ."      # exit 0 (allow) — BUG
$ rtk rewrite "cargo test && git add . && git commit -m foo"  # exit 0 (allow) — BUG

git add . alone correctly returns exit 3 (ask), but chaining it after an allowed
command escalates the entire chain to exit 0 (auto-allow).

Root cause

// src/hooks/permissions.rs — check_command_with_rules()
if !any_allow && !any_ask {
    for pattern in allow_rules {
        if command_matches_pattern(segment, pattern) {
            any_allow = true;  // set by first segment, never unset
            break;
        }
    }
}

Once the first segment sets any_allow = true, subsequent segments skip the allow
check entirely. The final verdict any_allow → Allow grants auto-allow to the
whole chain.

Expected behavior

A compound command should only receive Allow when all non-empty segments
individually match an allow rule. If any segment lacks an allow match, the verdict
should be Default (ask).

Suggested fix

Replace any_allow with all_allow logic:

let mut all_segments_allowed = true;

for segment in &segments {
    let segment = segment.trim();
    if segment.is_empty() { continue; }

    // deny — unchanged (any deny → immediate Deny)
    for pattern in deny_rules {
        if command_matches_pattern(segment, pattern) {
            return PermissionVerdict::Deny;
        }
    }

    // ask — unchanged
    if !any_ask {
        for pattern in ask_rules {
            if command_matches_pattern(segment, pattern) {
                any_ask = true;
                break;
            }
        }
    }

    // allow — check every segment independently
    if all_segments_allowed {
        let matched = allow_rules.iter()
            .any(|p| command_matches_pattern(segment, p));
        if !matched {
            all_segments_allowed = false;
        }
    }
}

if any_ask { PermissionVerdict::Ask }
else if all_segments_allowed && !allow_rules.is_empty() { PermissionVerdict::Allow }
else { PermissionVerdict::Default }

Impact

An LLM agent can construct <allowed_cmd> && <unapproved_cmd> to bypass user
confirmation on the second command. This is a permission escalation via compound
command chaining.

Related

• security: hook auto-allow bypasses agent permission model for rewritten commands #1155 (general hook auto-allow bypass)
• glob_matches fails to match middle-wildcard patterns when command has no trailing arguments #1105 (glob_matches bug in permissions.rs)

[pszymkowiak]

[w] wshm · Automated triage by AI

🔍 Automated Triage

🐛 Category	bug
🔴 Priority	critical
🎯 Confidence	96%

Summary

Security bug: compound command permission check uses any-match instead of all-match, allowing permission escalation via chaining. PR #1214 already in progress.

This looks like a simple fix. Only repo maintainers can trigger auto-fix.

📁 Relevant files

• src/hooks/permissions.rs

---

Triaged automatically by wshm · This is an automated analysis, not a human review.