Skip to content

Improve multiline shell-command analysis #3

Description

@Pavithran-R-A

Problem

SetupSentry does not fully parse multiline shell constructs. Some multi-line dangerous patterns may not be detected, including:

  • Heredocs with embedded commands
  • Line continuations that split a dangerous command across lines
  • Complex variable expansion that hides command execution
  • Pipelines that span multiple lines

Proposed Scope

Improve the markdown code block scanner to handle more multiline shell patterns:

  • Detect dangerous commands split across lines with backslash continuation
  • Detect heredoc patterns that pipe to shell
  • Improve pipeline detection across line boundaries

Files/Components

  • src/markdown.ts — code block extraction and line scanning
  • src/rules/ — rules that may need multiline context
  • tests/rules.test.ts — new multiline test cases

Acceptance Criteria

  • At least 3 new multiline pattern test cases added
  • Scanner detects dangerous commands split across 2+ lines
  • No increase in false positives on existing safe content
  • All existing tests still pass
  • README limitations section updated

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requesthelp wantedExtra attention is neededruleConcerns a specific scanner rule (SS001-SS010)

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions