Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Judged-script-body reader: four holes the gate found in the merged code (stdin redirect, wrapper arity, body heredocs, late-SAFE flags)

Chiusa
  • Qualcosa non va?
#132 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
bash, typescript
Ambito
security, testing-qa

Direzione di ricerca

Start in index.ts at the wrapper, stdin, heredoc, and late-verdict locations named in the issue, then run tests/script-body.test.ts and tests/late-verdict.test.ts. Trace how judgedCommand and riskFlags are built. Done means all four acceptance sections have regression coverage, including the stated behavior for unreadable redirects, unknown wrapper options, and body heredocs.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug ready-for-agent

This was generated by AI during triage.

The review gate found four holes in the judged-script-body reader (merged in e99d240, PR #121). Each is filed here rather than dismissed as out of scope, because the code, not the docs PR that surfaced them, is what needs changing; they are grouped in one issue because they share a surface and a fix round can take them together.

1. A redirected stdin script is not read

bash < installer          # installer contains: rm -rf ./out

< stays a token, so the reader takes it as the program and then skips the extensionless installer as a load operand (index.ts:3355), and bash -s < installer returns no refs at the -s (index.ts:3309). The deterministic stdin scan covers pipe stages (index.ts:3944) while the direct-interpreter overlay checks only -c/-e (index.ts:4004). A SAFE answer can therefore allow the body to run with no risk flag, where the same bytes read from disk are flagged (tests/script-body.test.ts:41-46, :91-98). Bash executes the redirected file's contents as code.

Acceptance: the body of a file redirected into an interpreter is read and judged; a flagged body raises the same flag as the on-disk spelling; a redirect of something that is not a readable file fails closed or is left alone, one of the two, stated.

2. A wrapper option's value hides the interpreter

env -u FOO python3 payload.py

The parser skips env, then -u, then stops at FOO because the wrapper-value check skips numeric values only (index.ts:3054-3063); FOO is not an interpreter, so payload.py is never read (index.ts:3066). env -u consumes its variable name, so Python is what runs.

Acceptance: env -u FOO python3 payload.py reads payload.py; the arity of the wrappers this repo recognizes is read from a table per wrapper, not from "is it a number"; an unknown wrapper option fails closed by making the command opaque rather than by guessing which word is the program.

3. A script body can hide a heredoc it later executes

A script whose body feeds a heredoc into another interpreter (or writes and runs one) has that inner payload stripped as inert, because the heredoc handling assumes a heredoc in the command text is data: the body's own heredocs never reach the risk scan (index.ts:6460, :6467). The reader's own model — "the bytes that were judged are the bytes that run" — needs the same treatment here, or the body's heredocs need to be scanned as executed text.

Acceptance: a body containing cat <<'EOF' > x.sh plus a later bash x.sh, or a heredoc piped into an interpreter, is flagged; the fix states which of the two models it takes (scan body heredocs as executed, or refuse the shape), and the regression fails before the change.

4. A late SAFE omits the script-body risk flags

The late-verdict guard (added with #62) builds its riskFlags from command rather than judgedCommand (index.ts:6552), so when a late SAFE dismisses a timeout dialog the guard is deciding on flags computed from the raw command text — the spliced script body's flags are absent. A body that trips matchModerateRiskTokens (or the interpreter-code markers) can therefore have its dialog dismissed by a late SAFE, which is exactly the case the guard exists to prevent.

Acceptance: the late-SAFE guard reads the same text the verdict was derived from (judgedCommand), with a regression that a body carrying a flagged operation keeps the dialog open under a late SAFE — driven through the real plugin with the late-verdict fixture (tests/late-verdict.test.ts).

Related

These sit beside the two residuals already recorded for this work: a script swapped between the read and execution (docs/plans/2026-09-19-intent-aware-judgment.md:307, accepted) and a sourced file that changes the directory (#130).

Lingua principale
TypeScript
Stelle
0
Fork
1
Merge medio
2h 5m
PR unite (30g)
61

Preparare l'ambiente

Non abbiamo ancora controllato i file di configurazione di questo progetto. Parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di STRML/omp-classifier

Tutte le issue di STRML/omp-classifier

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.