From 3227cc65d14c4645c8b7e5e863eafc8d1cb12be9 Mon Sep 17 00:00:00 2001 From: darya <137614867+cutepawss@users.noreply.github.com> Date: Thu, 26 Feb 2026 16:32:01 +0300 Subject: [PATCH] fix: prevent false positives in recursive delete detection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The regex pattern for detecting recursive delete commands (rm -r, rm -rf, etc.) incorrectly matched filenames starting with 'r' — e.g., 'rm readme.txt' was flagged as 'recursive delete' because the dash-flag group was optional. Fix: make the dash mandatory so only actual flags (-r, -rf, -rfv, -fr) are matched. This eliminates false approval prompts for innocent commands like 'rm readme.txt', 'rm requirements.txt', 'rm report.csv', etc. Before: \brm\s+(-[^\s]*)?r — matches 'rm readme.txt' (false positive) After: \brm\s+-[^\s]*r — requires '-' prefix, no false positives --- tools/approval.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/approval.py b/tools/approval.py index 18f9b6743..3d17bd2b0 100644 --- a/tools/approval.py +++ b/tools/approval.py @@ -22,7 +22,7 @@ logger = logging.getLogger(__name__) DANGEROUS_PATTERNS = [ (r'\brm\s+(-[^\s]*\s+)*/', "delete in root path"), - (r'\brm\s+(-[^\s]*)?r', "recursive delete"), + (r'\brm\s+-[^\s]*r', "recursive delete"), (r'\brm\s+--recursive\b', "recursive delete (long flag)"), (r'\bchmod\s+(-[^\s]*\s+)*777\b', "world-writable permissions"), (r'\bchmod\s+--recursive\b.*777', "recursive world-writable (long flag)"),