gemini-cli - ✅(Solved) Fix [Security] Improve dangerous command detection for rm and fix YOLO mode heuristics bypass [2 pull requests, 1 participants]

cocosheng-g · 2026-04-16T16:51:49Z

[gemini-cli] The dangerous command detection for rm was found to be fragile, only catching specific flag combinations in the first argument position. This allo… The dangerous command detection for `rm` was found to be fragile, only catching specific flag combinations in the first argument position. This allowed path-qualified calls (e.g., `/bin/rm`) and split flags (e.g., `rm -r -f`) to bypass safety heuristics. # PR #25544: security: improve dangerous command detection for rm and fix YOLO bypass - Repository: google-gemini/gemini-cli - Author: cocosheng-g - State: closed | merged: False - Link: https://github.com/google-gemini/gemini-cli/pull/25544 ## Description (problem / solution / changelog) ## Summary Improve dangerous command detection for `rm`, `del`, and `erase` to prevent accidental mass deletion. Fix a bug where shell heuristics were bypassed in YOLO mode. ## Details - **Robust `rm` Detection**: Updated `isDangerousCommand` to correctly identify `rm`, `del`, and `erase` regardless of path qualification or flag ordering. - **Inherently Dangerous Tools**: These commands are now always flagged as dangerous unless they are help/version requests (`--help`, etc.). - **YOLO Mode Safety Net**: Fixed a bug in `PolicyEngine.check` to ensure shell heuristics are always applied in YOLO mode, preventing silent bypasses for dangerous commands. - **UI Transparency**: Updated confirmation labels to clearly state that permissions apply to the entire tool (e.g., "Allow all 'rm' commands for this session"). ## Related Issues Closes #25543 ## How to Validate 1. Run `npm test -w @google/gemini-cli-core -- src/policy/policy-engine.test.ts` to verify the new test cases. 2. Manually test with `rm test.txt` in YOLO mode and verify it triggers a confirmation prompt. 3. Verify that path-qualified calls like `/bin/rm -rf` are also caught. ## Pre-Merge Checklist - [ ] Updated relevant documentation and README (if needed) - [x] Added/updated tests (if needed) - [ ] Noted breaking changes (if any) - [x] Validated on required platforms/methods: - [x] MacOS - [x] npm run ## Changed files - `packages/cli/src/ui/components/messages/ToolConfirmationMessage.tsx` (modified, +3/-2) - `packages/cli/src/ui/components/messages/__snapshots__/ToolConfirmationMessage.test.tsx.snap` (modified, +8/-8) - `packages/core/src/policy/policy-engine.test.ts` (modified, +11/-33) - `packages/core/src/policy/policy-engine.ts` (modified, +12/-20) - `packages/core/src/sandbox/utils/commandSafety.test.ts` (added, +81/-0) - `packages/core/src/sandbox/utils/commandSafety.ts` (modified, +13/-2) --- # PR #25545: security: improve dangerous command detection for rm - Repository: google-gemini/gemini-cli - Author: cocosheng-g - State: open | merged: False - Link: https://github.com/google-gemini/gemini-cli/pull/25545 ## Description (problem / solution / changelog) ## Summary Improve dangerous command detection for `rm` to prevent accidental mass deletion. ## Details - **Robust `rm` Detection**: Updated `isDangerousCommand` in POSIX environments to correctly identify `rm` regardless of path qualification (e.g., `/bin/rm`) or flag ordering. - **Inherently Dangerous Tools**: The `rm` command is now always flagged as dangerous, removing the fragile check that only looked for specific flags like `-rf` in the first argument position. - **Platform Specificity**: Maintained platform-specific checks (e.g., `del` and `erase` remain Windows-specific dangerous commands, and `rm` is correctly scoped to POSIX). ## Related Issues Closes #25543 ## How to Validate 1. Run `npm test -w @google/gemini-cli-core -- src/sandbox/utils/commandSafety.test.ts` to verify the improved POSIX safety heuristics. 2. Manually test with `rm test.txt` and verify it triggers a confirmation prompt. ## Pre-Merge Checklist - [ ] Updated relevant documentation and README (if needed) - [x] Added/updated tests (if needed) - [ ] Noted breaking changes (if any) - [x] Validated on required platforms/methods: - [x] MacOS - [x] npm run ## Changed files - `packages/core/src/sandbox/utils/commandSafety.test.ts` (added, +91/-0) - `packages/core/src/sandbox/utils/commandSafety.ts` (modified, +3/-2) - `packages/core/src/sandbox/windows/commandSafety.test.ts` (modified, +6/-0) - `packages/core/src/sandbox/windows/commandSafety.ts` (modified, +2/-4) ## Fixed - Fixed by PR: security: improve dangerous command detection for rm and fix YOLO bypass (https://github.com/google-gemini/gemini-cli/pull/25544) - Fixed by PR: security: improve dangerous command detection for rm (https://github.com/google-gemini/gemini-cli/pull/25545) ### Description The dangerous command detection for `rm` was found to be fragile, only catching specific flag combinations in the first argument position. This allowed path-qualified calls (e.g., `/bin/rm`) and split flags (e.g., `rm -r -f`) to bypass safety heuristics. ### Improvements Made 1. **Robust `rm` Detection**: Updated `isDangerousCommand` to correctly identify `rm`, `del`, and `erase`

Description

The dangerous command detection for rm was found to be fragile, only catching specific flag combinations in the first argument position. This allowed path-qualified calls (e.g., /bin/rm) and split flags (e.g., rm -r -f) to bypass safety heuristics.

Improvements Made

Robust rm Detection: Updated isDangerousCommand to correctly identify rm, del, and erase regardless of path qualification or flag ordering.
Inherently Dangerous Tools: These commands are now always flagged as dangerous.
UI Transparency: Updated confirmation labels to clearly state that permissions apply to the entire tool (e.g., "Allow all 'rm' commands for this session").

I have already implemented these fixes and verified them with new test cases.

TL;DR

The issue can be resolved by updating the isDangerousCommand function to correctly identify rm, del, and erase commands regardless of path qualification or flag ordering.

Guidance

Review the updated isDangerousCommand function to ensure it correctly handles various command formats, such as path-qualified calls and split flags.
Verify that the new test cases cover different scenarios, including edge cases like /bin/rm and rm -r -f.
Check the UI confirmation labels to ensure they clearly state the permissions scope for the entire tool.
Test the updated functionality with various command combinations to ensure the safety heuristics are working as expected.

Example

No code snippet is provided as the issue does not contain specific code details.

Notes

The provided information implies that the issue has already been fixed and verified with new test cases. However, it's still important to review and test the changes to ensure they work as expected in different scenarios.

Recommendation

Apply the workaround by using the updated isDangerousCommand function, as it provides more robust detection of dangerous commands.

gemini-cli - ✅(Solved) Fix [Security] Improve dangerous command detection for rm and fix YOLO mode heuristics bypass [2 pull requests, 1 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Fix Action

Fixed

PR fix notes

PR #25544: security: improve dangerous command detection for rm and fix YOLO bypass

Description (problem / solution / changelog)

Summary

Details

Related Issues

How to Validate

Pre-Merge Checklist

Changed files

PR #25545: security: improve dangerous command detection for rm