chore: port desctructive/exfil/SC rules by sarahxsanders · Pull Request #12 · PostHog/warlock

sarahxsanders · 2026-04-24T20:56:06Z

Note: stacked on top of the prompt-injection PR #10

Summary

more warlock ports for destructive exfil and supply chain rules + a bit of type and test infrastructure cleanup

new rules

9 rules:

destructive_git_force_push – medium/warn
destructive_git_force_push_protected_branch – critical/block
destructive_git_working_tree_loss – high/block
destructive_recursive_delete – medium/warn
destructive_recursive_delete_high_risk – critical/block
exfiltration_secret_via_shell – critical/block
supply_chain_wrong_posthog_package – high/block
supply_chain_package_json_exfil – critical/block (new, not a port)
supply_chain_github_workflow_exfil – critical/block (new, not a port)

rename: `action: "revert"` → `action: "remediate"`

renamed across posthog_pii_in_capture_call, posthog_hardcoded_personal_api_key, and the Action type.

why???????

revert collides with git vocabulary – reads like "run git revert" next to the new git push rules
implies something already happened, but warlock fires pre-write AND post-write; remediate covers both
standard term in Semgrep/Snyk, so consumers already recognize it

new helpers

3 new helpers in helpers.ts:

expectRuleMatch(content, ruleName) – asserts the specific rule matched, not "some rule matched."
expectRulesMatch(content, ruleNames[]) – asserts every named rule fires. Used for companion-rule tests.
expectRuleDidNotMatch(content, ruleName) – asserts the specific rule stayed silent.

type hygiene

added ACTIONS const + Action type, same append-only pattern as CATEGORIES / Severity
action?: Action on RuleMetadata so typos get caught at build time
expectRuleMetadata helper uses the real types now, not bare `string

companion-rule tests

new companion_rules.test.ts with 6 tests locking in that paired rules both fire on shared inputs (e.g. rm -rf / → both destructive-delete rules, git push --force origin main → both force-push rules). prevents silent drift where one companion breaks but the other compensates

Test plan

pnpm test – 314/314 green
Spot-check rule metadata on a matched scan (severity, category, action, remediation strings all present)
pnpm build succeeds (type narrowing on the new Action type)

gewenyu99

Thanks for putting these together! I will surely lose sleep thinking about these now xD

gewenyu99 · 2026-05-01T21:21:46Z

+// rule destructive_git_force_push_protected_branch handles the
+// critical case where the target is a protected branch.
+
+rule destructive_git_force_push


ah nice you cover it here

gewenyu99 · 2026-05-01T21:24:33Z

+        action = "block"
+
+    strings:
+        // git reset --hard (with or without a target)


git rebase -i HEAD~<some number> can also be quite annoying. You won't lose code, but you will lose commit history. This lets you squash commits so that the past N commits are squashed together

gonna add this and a few others as issues for the backlog to do in a quick follow up https://github.com/PostHog/warlock/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen

gewenyu99 · 2026-05-01T21:25:42Z

+        action = "warn"
+
+    strings:
+        // rm -rf / -fr / -Rf / -fR / -r -f / -f -r / --recursive --force / --force --recursive


Can/should we break these into multiple rules? This is getting very hard to read, and I think long term htis regex pattern is gonna be more error prone...

I'm not entirely sure how tho

gewenyu99 · 2026-05-01T21:26:26Z

+    strings:
+        // rm -rf (and -fr / -Rf / -fR / etc) aimed at root, home, bare
+        // wildcard, bare dot / dotdot, or a canonical system path
+        $rm_recursive_dangerous = /\brm\s+(-[a-zA-Z]*[rR][a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*[rR]|-[rR]\s+-f|-f\s+-[rR]|--recursive\s+--force|--force\s+--recursive)\s+("\/"|'\/'|\/($|\s|\*)|~($|\/|\s)|\.($|\s)|\.\.($|\s)|\*($|\s)|\/(etc|bin|sbin|usr|var|home|Users|sys|boot|lib|opt|root)(\/|\s|$))/


Same with comment above. There might be a case where we can have different pattern for each of `-fr, -Rf, -fR, etc.)

gewenyu99 · 2026-05-01T21:27:33Z

+        // variable turns this into rm -rf /
+        $rm_recursive_unquoted_var = /\brm\s+(-[a-zA-Z]*[rR][a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*[rR]|-[rR]\s+-f|-f\s+-[rR]|--recursive\s+--force|--force\s+--recursive)\s+\$[A-Za-z_{]/
+
+        // sudo + any recursive rm (target doesn't matter, sudo escalates the blast radius)


Should there be a rule against user switching and sudo in general? all sudo and su commands should be blocked

gewenyu99 · 2026-05-01T21:34:44Z

 {
    meta:
-        description = "Base64 blob (40+ chars) embedded in a code comment. A common way to hide prompt-injection instructions from human reviewers."
+        description = "Long base64 blob (100+ chars) embedded in a code comment. A common way to hide prompt-injection instructions from human reviewers."


Similar to before. I feel like blobs are just sus in comments. Maybe we can be more strict here... I'm not sure

gewenyu99 · 2026-05-01T21:36:50Z

        // "workflows", "endpoints") — require a posthog qualifier
        // somewhere in the phrase.
-        $attack_generic_feature_posthog_qualifier = /\b(disable|turn\s+off|stop|skip|remove|break|bypass|deactivate|kill|stop\s+using|comment\s+out|(don'?t|do\s+not)\s+(enable|use|track))\s+(the\s+)?posthog\s+(product\s+analytics|web\s+analytics|error\s+(tracking|monitoring)|surveys?|support|data\s+(pipelines?|warehouse)|llm\s+analytics|revenue\s+analytics|customer\s+analytics|workflows?|logs?|endpoints?|identify|event\s+(tracking|capture))\b/i
+        $attack_generic_feature_posthog_qualifier = /\b(disable|turn\s+off|stop|skip|remove|break|bypass|deactivate|kill|don'?t\s+(enable|use|track))\s+(the\s+)?posthog\s+(product\s+analytics|web\s+analytics|error\s+(tracking|monitoring)|surveys?|support|data\s+(pipelines?|warehouse)|llm\s+analytics|revenue\s+analytics|customer\s+analytics|workflows?|logs?|endpoints?|identify|event\s+tracking)\b/i


This is really cool? what would something like this do?

if an attacker could disable session replay for example, it could blind the customer so they can't see what happens during another attacker. if there's no session replay or event tracking, it's harder to notice malicious behavior or trigger alarm bells. imo a sophisticated attacker could do this instead of uninstalling the SDK because it would go longer unnoticed

gewenyu99 · 2026-05-01T21:37:26Z

-        // qualifier): "posthog surveys should be disabled"
-        $attack_passive_generic = /\bposthog\s+(product\s+analytics|web\s+analytics|error\s+(tracking|monitoring)|surveys?|support|data\s+(pipelines?|warehouse)|llm\s+analytics|revenue\s+analytics|customer\s+analytics|workflows?|logs?|endpoints?|identify|event\s+(tracking|capture))\s+(should\s+be|must\s+be|has\s+to\s+be|have\s+to\s+be|needs\s+to\s+be|need\s+to\s+be|is\s+to\s+be|are\s+to\s+be)\s+(disabled|removed|skipped|deactivated|turned\s+off|killed|broken|bypassed)\b/i
+        $attack_skip_capture_call = /\b(skip|remove|delete|don'?t\s+(add|include|call))\s+(the\s+)?(posthog\.)?(capture|identify|reset|group)\s*\(/i



lol (this is just for memes) is there a world where someone could inject, say, amplitude in comments to make the wizard install amplitude instead?

honestly yeah this is a legit attack vector 😆 #20 had PHCode log it in the backlog

gewenyu99 · 2026-05-01T21:46:27Z

+
+    condition:
+        $install_bare_posthog and not $install_suffixed_posthog
+}


Do we have a separate thing for things like:

pointing package managers to non npm registries? npm config set registry https://registry.totally-legit.com/

pointing package managers to local registries

etc.

Break down the flag-combo and dangerous-target alternations in the recursive delete rules so each branch of the regex is documented. No pattern changes — comments only. Generated-By: PostHog Code Task-Id: cd736619-e011-4bb0-abfc-a92066533ccf

sarahxsanders requested a review from a team April 24, 2026 21:28

sarahxsanders changed the base branch from main to port-prompt-injection-rules April 27, 2026 17:20

sarahxsanders changed the title ~~chore: port desctructive, exfil, and supply chain rules~~ chore: port desctructive/exfil/SC rules Apr 27, 2026

sarahxsanders mentioned this pull request Apr 27, 2026

chore: port host and more SC rules #13

Merged

3 tasks done

Base automatically changed from port-prompt-injection-rules to main May 1, 2026 21:05

gewenyu99 approved these changes May 1, 2026

View reviewed changes

sarahxsanders added 4 commits May 4, 2026 15:09

chore: port exfiltration rules

d42cab0

harden

246da6a

edit comments and remove internal references

cd7d246

more comment edits, clarity

e2be098

sarahxsanders force-pushed the port-destructive-exfil-supply-rules branch from 4dbacca to 65443fc Compare May 4, 2026 19:33

sarahxsanders merged commit 93c660f into main May 4, 2026
9 checks passed

sarahxsanders deleted the port-destructive-exfil-supply-rules branch May 4, 2026 19:37

sarahxsanders mentioned this pull request Jun 5, 2026

docs: fix stale action enum values in docs #34

Open

2 tasks done

Conversation

sarahxsanders commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

new rules

rename: action: "revert" → action: "remediate"

new helpers

type hygiene

companion-rule tests

Test plan

Uh oh!

gewenyu99 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sarahxsanders commented Apr 24, 2026 •

edited

Loading

rename: `action: "revert"` → `action: "remediate"`