import{c as a,Q as s,j as t,m as i}from"./chunks/framework.BPKcPtvA.js";const u=JSON.parse('{"title":"L3a: L4 Whitelist Hook","description":"","frontmatter":{},"headers":[],"relativePath":"labs/l3-whitelist-hook.md","filePath":"labs/l3-whitelist-hook.md","lastUpdated":null}'),l={name:"labs/l3-whitelist-hook.md"};function n(o,e,r,p,h,c){return s(),t("div",null,[...e[0]||(e[0]=[i(`

L3a: L4 Whitelist Hook ​

Implement a production-grade L4 security whitelist hook.

Module: M3 Safety & Security
Est. Time: 60 min
Files: starter.py, solution.py

Objective ​

Block ALL bash commands except 10 safelisted patterns. This prevents the L3 marque break (agent writing and running scripts).

Concepts ​

Starter ​

bash
cd course/labs/L3-whitelist-hook/
python starter.py

The starter has:

  1. A safelist patterns list (currently empty)
  2. A compound operators detector (currently empty)
  3. A whitelist check function (currently TODO)
  4. Test cases for both ALLOWED and BLOCKED commands

Solution ​

bash
python solution.py

Key Design Rules ​

  1. Pin specific scripts: ^npm test$ not ^npm .*$
  2. Never pattern-match an interpreter: ^python .*$ allows running any script
  3. Block compound operators before regex
  4. Audit log all blocks

Test Cases ​

npm test          → ALLOW
git status        → ALLOW
rm -rf target/    → BLOCK
python cleanup.py → BLOCK (L3 marque break)
npm test && rm -rf / → BLOCK (compound operator)
`,17)])])}const k=a(l,[["render",n]]);export{u as __pageData,k as default};