Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

floor: the secret-file check can't see runtime values (globs, expansion side effects, symlinks, code)

Aperta
#97 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python, shell, typescript
Ambito
security

Direzione di ricerca

Start with floor.ts and section 4 of docs/plans/2026-09-22-real-shell-parser.md, then review the runtime file resolution described in #67 and spawn interception in the eval kernel from #13. Done means the reviewer sees the files opened at runtime or the argv actually spawned, rather than only source spellings.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

The floor's secret-file check is a check on names, and names don't cover runtime values. PR #96 hit the Codex review cap on this: each of three rounds found a new runtime spelling, and the class doesn't close by adding spellings.

Passes the floor Why a name check can't see it
cat .e* the glob matches whatever is on disk
cat ${x:=key.txt} ${x/txt/pem} the first expansion assigns x, the second reads it
ln -s ~/.aws/credentials notes.txt && cat notes.txt a symlink renames any file
subprocess.run(["o" "p", "read", "op://v/i/c"]) in eval Python joins the literals, and the floor doesn't evaluate Python

What #96 does about it: the floor reads each word as the text it's written as, so *.pem still asks and .e* doesn't. The limit is written down as a decision in docs/plans/2026-09-22-real-shell-parser.md section 4. Every one of these reaches the reviewer.

This issue tracks whether anything below the reviewer should close it. Two ways that would actually work, not more spellings:

  • For shell, judge the file the command opens, not its name. That means resolving it at run time, the same move #67 makes for script bodies. Symlinks need this too.
  • For code, intercept the spawn in the eval kernel (#13) so the floor sees the argv the kernel runs, not the source text.

Until then, don't add glob samples, expansion simulation, or language-specific string parsing to floor.ts. Rounds 2 and 3 on #96 show where that goes.

Related: #95 (the summary's version of the same limit), #91.

Lingua principale
TypeScript
Stelle
0
Fork
1
Merge medio
1h 15m
PR unite (30g)
49

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di STRML/omp-classifier

Tutte le issue di STRML/omp-classifier

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.