Skip to main content

check_command_allowlist

par_term::config

Function check_command_allowlist 

Source 
pub fn check_command_allowlist(
    command: &str,
    allowed_commands: &[String],
) -> Result<(), String>
Expand description

SEC-002: Check if a command is allowed by the optional allowlist.

When allowed_commands is non-empty, the command’s binary name (first token) must match at least one entry in the allowlist. Matching is case-insensitive.

Returns Ok(()) if the command is allowed. Returns Err(allowlist_violation) if the command is not on the allowlist.

When allowed_commands is empty, returns Ok(()) (allowlist mode disabled; falls back to denylist-only checking).

§Matching behavior

Each entry in allowed_commands is compared against:

  1. The command string directly (case-insensitive contains match on the command binary).
  2. The basename of the command (for path-style commands like /usr/bin/git, the basename git is extracted and compared).

This means an allowlist entry of "git" will match both git and /usr/bin/git.

§Errors

Returns an error naming the command and the allowlist when allowed_commands is non-empty and no entry matches. An empty allowlist disables the check and always returns Ok(()).