Repository navigation
damage-control: hidden input behind same-line openers and wrapper -c (#1144) - #1146
Merged
Merged
Conversation
…and wrapper -c is judged (#1144) Cut the feed line at its last segment break before stripping openers, and let the -c payload scan step past prefix wrappers. Differential matrix test: every hidden-input form x opener/wrapper == top-level decision. Built by dotdev.dev
…ged (#1144) Built by dotdev.dev
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two wrongful ALLOWs from the #1138 review, both fixed:
if true; then sh <<< X; fi, alsofor/while/until,true; then): the feed line was not cut at its last segment break, so the keyword became the head word. Now cut before opener stripping.sudo|env|nohup|timeout N bash -c 'sh <<< X'(also heredoc): the-cpayload scan only looked at a bare shell head; it now steps past prefix wrappers via_wrapped_command_index.Tests:
test_damage_control_hidden_input_positions.py, a differential matrix (here-string / heredoc /< <(...)) x 13 openers/wrappers == top-level decision. Mutation-checked: reverting the fix turns both tests red.Audit-log replay (1685 distinct
<</<(commands): 0 decision diffs. Full fast suite: 5951 passed. Rule baselines--checkclean. Wiki residual moved out.Not done: inventory item 19 (heredoc into
xargs -I{} sh -c '{}') already blocks on main and is pinned in the existing carriers; item 14 table edits (parallel/flock/docker-run, bareevalasks) skipped.Closes #1144
Built by dotdev.dev