Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Judged-script-body reader: four holes the gate found in the merged code (stdin redirect, wrapper arity, body heredocs, late-SAFE flags)

Abierto
  • ¿Algo no está bien?
#132 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
bash, typescript
Área
security, testing-qa

Línea de trabajo

Start in index.ts at the wrapper, stdin, heredoc, and late-verdict locations named in the issue, then run tests/script-body.test.ts and tests/late-verdict.test.ts. Trace how judgedCommand and riskFlags are built. Done means all four acceptance sections have regression coverage, including the stated behavior for unreadable redirects, unknown wrapper options, and body heredocs.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug ready-for-agent

This was generated by AI during triage.

The review gate found four holes in the judged-script-body reader (merged in e99d240, PR #121). Each is filed here rather than dismissed as out of scope, because the code, not the docs PR that surfaced them, is what needs changing; they are grouped in one issue because they share a surface and a fix round can take them together.

1. A redirected stdin script is not read

bash < installer          # installer contains: rm -rf ./out

< stays a token, so the reader takes it as the program and then skips the extensionless installer as a load operand (index.ts:3355), and bash -s < installer returns no refs at the -s (index.ts:3309). The deterministic stdin scan covers pipe stages (index.ts:3944) while the direct-interpreter overlay checks only -c/-e (index.ts:4004). A SAFE answer can therefore allow the body to run with no risk flag, where the same bytes read from disk are flagged (tests/script-body.test.ts:41-46, :91-98). Bash executes the redirected file's contents as code.

Acceptance: the body of a file redirected into an interpreter is read and judged; a flagged body raises the same flag as the on-disk spelling; a redirect of something that is not a readable file fails closed or is left alone, one of the two, stated.

2. A wrapper option's value hides the interpreter

env -u FOO python3 payload.py

The parser skips env, then -u, then stops at FOO because the wrapper-value check skips numeric values only (index.ts:3054-3063); FOO is not an interpreter, so payload.py is never read (index.ts:3066). env -u consumes its variable name, so Python is what runs.

Acceptance: env -u FOO python3 payload.py reads payload.py; the arity of the wrappers this repo recognizes is read from a table per wrapper, not from "is it a number"; an unknown wrapper option fails closed by making the command opaque rather than by guessing which word is the program.

3. A script body can hide a heredoc it later executes

A script whose body feeds a heredoc into another interpreter (or writes and runs one) has that inner payload stripped as inert, because the heredoc handling assumes a heredoc in the command text is data: the body's own heredocs never reach the risk scan (index.ts:6460, :6467). The reader's own model — "the bytes that were judged are the bytes that run" — needs the same treatment here, or the body's heredocs need to be scanned as executed text.

Acceptance: a body containing cat <<'EOF' > x.sh plus a later bash x.sh, or a heredoc piped into an interpreter, is flagged; the fix states which of the two models it takes (scan body heredocs as executed, or refuse the shape), and the regression fails before the change.

4. A late SAFE omits the script-body risk flags

The late-verdict guard (added with #62) builds its riskFlags from command rather than judgedCommand (index.ts:6552), so when a late SAFE dismisses a timeout dialog the guard is deciding on flags computed from the raw command text — the spliced script body's flags are absent. A body that trips matchModerateRiskTokens (or the interpreter-code markers) can therefore have its dialog dismissed by a late SAFE, which is exactly the case the guard exists to prevent.

Acceptance: the late-SAFE guard reads the same text the verdict was derived from (judgedCommand), with a regression that a body carrying a flagged operation keeps the dialog open under a late SAFE — driven through the real plugin with the late-verdict fixture (tests/late-verdict.test.ts).

Related

These sit beside the two residuals already recorded for this work: a script swapped between the read and execution (docs/plans/2026-09-19-intent-aware-judgment.md:307, accepted) and a sourced file that changes the directory (#130).

Lenguaje dominante
TypeScript
Estrellas
0
Forks
1
Merge medio
1 h 58 min
PR fusionados (30 d)
53

Preparar el entorno

Aún no hemos revisado los archivos de configuración de este proyecto. Empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de STRML/omp-classifier

Todos los issues de STRML/omp-classifier

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.