Skip to content

Improve multiline shell-command analysis #3

Description

@Pavithran-R-A

Problem

SetupSentry does not fully parse multiline shell constructs. Some multi-line dangerous patterns may not be detected, including:

  • Heredocs with embedded commands
  • Line continuations that split a dangerous command across lines
  • Complex variable expansion that hides command execution
  • Pipelines that span multiple lines

Proposed Scope

Improve the markdown code block scanner to handle more multiline shell patterns:

  • Detect dangerous commands split across lines with backslash continuation
  • Detect heredoc patterns that pipe to shell
  • Improve pipeline detection across line boundaries

Files/Components

  • src/markdown.ts — code block extraction and line scanning
  • src/rules/ — rules that may need multiline context
  • tests/rules.test.ts — new multiline test cases

Acceptance Criteria

  • At least 3 new multiline pattern test cases added
  • Scanner detects dangerous commands split across 2+ lines
  • No increase in false positives on existing safe content
  • All existing tests still pass
  • README limitations section updated

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requesthelp wantedExtra attention is neededruleConcerns a specific scanner rule (SS001-SS010)

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions