Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Judged-script-body reader: four holes the gate found in the merged code (stdin redirect, wrapper arity, body heredocs, late-SAFE flags)

Đã đóng
  • Có gì không ổn?
#132 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
bash, typescript
Lĩnh vực
security, testing-qa

Hướng nghiên cứu

Start in index.ts at the wrapper, stdin, heredoc, and late-verdict locations named in the issue, then run tests/script-body.test.ts and tests/late-verdict.test.ts. Trace how judgedCommand and riskFlags are built. Done means all four acceptance sections have regression coverage, including the stated behavior for unreadable redirects, unknown wrapper options, and body heredocs.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

bug ready-for-agent

This was generated by AI during triage.

The review gate found four holes in the judged-script-body reader (merged in e99d240, PR #121). Each is filed here rather than dismissed as out of scope, because the code, not the docs PR that surfaced them, is what needs changing; they are grouped in one issue because they share a surface and a fix round can take them together.

1. A redirected stdin script is not read

bash < installer          # installer contains: rm -rf ./out

< stays a token, so the reader takes it as the program and then skips the extensionless installer as a load operand (index.ts:3355), and bash -s < installer returns no refs at the -s (index.ts:3309). The deterministic stdin scan covers pipe stages (index.ts:3944) while the direct-interpreter overlay checks only -c/-e (index.ts:4004). A SAFE answer can therefore allow the body to run with no risk flag, where the same bytes read from disk are flagged (tests/script-body.test.ts:41-46, :91-98). Bash executes the redirected file's contents as code.

Acceptance: the body of a file redirected into an interpreter is read and judged; a flagged body raises the same flag as the on-disk spelling; a redirect of something that is not a readable file fails closed or is left alone, one of the two, stated.

2. A wrapper option's value hides the interpreter

env -u FOO python3 payload.py

The parser skips env, then -u, then stops at FOO because the wrapper-value check skips numeric values only (index.ts:3054-3063); FOO is not an interpreter, so payload.py is never read (index.ts:3066). env -u consumes its variable name, so Python is what runs.

Acceptance: env -u FOO python3 payload.py reads payload.py; the arity of the wrappers this repo recognizes is read from a table per wrapper, not from "is it a number"; an unknown wrapper option fails closed by making the command opaque rather than by guessing which word is the program.

3. A script body can hide a heredoc it later executes

A script whose body feeds a heredoc into another interpreter (or writes and runs one) has that inner payload stripped as inert, because the heredoc handling assumes a heredoc in the command text is data: the body's own heredocs never reach the risk scan (index.ts:6460, :6467). The reader's own model — "the bytes that were judged are the bytes that run" — needs the same treatment here, or the body's heredocs need to be scanned as executed text.

Acceptance: a body containing cat <<'EOF' > x.sh plus a later bash x.sh, or a heredoc piped into an interpreter, is flagged; the fix states which of the two models it takes (scan body heredocs as executed, or refuse the shape), and the regression fails before the change.

4. A late SAFE omits the script-body risk flags

The late-verdict guard (added with #62) builds its riskFlags from command rather than judgedCommand (index.ts:6552), so when a late SAFE dismisses a timeout dialog the guard is deciding on flags computed from the raw command text — the spliced script body's flags are absent. A body that trips matchModerateRiskTokens (or the interpreter-code markers) can therefore have its dialog dismissed by a late SAFE, which is exactly the case the guard exists to prevent.

Acceptance: the late-SAFE guard reads the same text the verdict was derived from (judgedCommand), with a regression that a body carrying a flagged operation keeps the dialog open under a late SAFE — driven through the real plugin with the late-verdict fixture (tests/late-verdict.test.ts).

Related

These sit beside the two residuals already recorded for this work: a script swapped between the read and execution (docs/plans/2026-09-19-intent-aware-judgment.md:307, accepted) and a sourced file that changes the directory (#130).

Ngôn ngữ chính
TypeScript
Star
0
Fork
1
Merge trung bình
2 giờ 5 phút
Pull request đã merge (30 ngày)
61

Chuẩn bị môi trường

Chúng tôi chưa kiểm tra các tệp thiết lập môi trường của dự án này. Hãy bắt đầu từ README và xem hướng dẫn đóng góp lần đầu của chúng tôi để biết các bước chung.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của STRML/omp-classifier

Tất cả issue của STRML/omp-classifier

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.