Allowlist philosophy and security hardening#43
Merged
Conversation
Command substitutions were not being analyzed in several contexts: - for loop iteration words - select word list - case word - redirect targets - subshell and brace-group redirects This could allow dangerous commands like `rm` to execute undetected when embedded in these constructs.
…ram expansions
Additional security gaps found and fixed:
- arith-cmd: check redirects on (( expr )) constructs
- for-arith: extract and analyze $(cmd) in init/cond/incr strings
- param expansion: analyze cmdsubs in ${x:-$(cmd)} style constructs
Adds _analyze_string_cmdsubs() helper to parse $(cmd) from raw strings
where Parable doesn't provide full AST nodes.
- Add backtick command substitution detection to _analyze_string_cmdsubs - Analyze unquoted heredoc content for command substitutions - Quoted heredocs (<<'EOF') are safely skipped as they don't expand
The allowlist approach means unknown commands default to ask. UNSAFE_PATTERNS was redundant since both matched and unmatched unknown commands resulted in ask. Update test expectations for more descriptive reason strings.
Analyzer now handles all AST walking directly. Keep only tokenize().
ldayton
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary