[bug/sec] correct autocomplete of forbidden dirs (Closes #109)

lshell/shellcmd.py

@@ -500,9 +500,14 @@ def check_path(self, line, completion=None, ssh=None, strict=None):
             if denied_path_re: 
                 match_denied = re.findall(denied_path_re, tomatch)
             else: match_denied = None
+            # if path not allowed
+            # case path executed: warn, and return 1
+            # case completion: return 1
             if not match_allowed or match_denied:
                 if not completion:
-                    return self.warn_count('path', tomatch, strict, ssh)
+                    self.warn_count('path', tomatch, strict, ssh)
+                return 1
+
         if not completion:
             if not re.findall(allowed_path_re, os.getcwd()+'/'):
                 if not ssh:

test/test_unit.py

@@ -68,6 +68,14 @@ def test_checkpath_notallowed_path(self):
     INPUT = "cd /tmp"
     return self.assertEqual(shell.check_path(INPUT), 1)
 
+  def test_checkpath_notallowed_path_completion(self):
+    """ forbidden command, should return 1 """
+    args = self.args + ["--path=['/home', '/var']"]
+    userconf = CheckConfig(args).returnconf()
+    shell = ShellCmd(userconf, args)
+    INPUT = "cd /tmp/"
+    return self.assertEqual(shell.check_path(INPUT, completion=1), 1)
+
   def test_checkpath_dollarparenthesis(self):
     """ when $() is allowed, return 0 if path allowed """
     args = self.args + ["--forbidden=[';', '&', '|','`','>','<', '${']"]