Inconsistency between "RNC shell SH.FLOW.CheckUser example" and "I-code COMDESIGNActiveWait LEX"

[furmanc]

Expected behavior

The correct example for RNC shell rule SH.FLOW.CheckUser allows the usage of read command:
if [ "${current_user}" == "root" ]; then
echo "! Execution avec les droits de $current_user !"
echo -n "! Voulez-vous continuer (Oui,Non) ?"
read reponse
if [ "${reponse}" == "N" ] || [ "${reponse}" == "Non" ] || [
"${reponse}" == "n" ] || [ "${reponse}" == "non" ]; then
echo "Sortie du script ..."
exit
fi
fi

So if we copy this example in our shell script, we expect no error.

Actual behavior

In i-code LEX of COMDESIGNActiveWait rule "read" is considered as active wait command:
ACTWAIT = "read" | "sleep" | "wait"

So if we copy the RNC correct example of rule SH.FLOW.CheckUser (above) we have an COMDESIGNActiveWait error

Steps to reproduce behavior

Use the example of RNC shell rule SH.FLOW.CheckUser (above) in a script

Detection version

V3.0.1

[furmanc]

Another example that justify "read" command shall be excluded from the list of ActiveWait commands is describe below. Indded, in this example read command is a nominal shell use to read each file line.

LISTE_PRODUITS=file.txt
if [ ! -e ${LISTE_PRODUITS} ]
then
echo ${LISTE_PRODUITS} "does not exit"
exit 1
fi

while read line
do
"treatment of each line of the file
done < ${LISTE_PRODUITS}

[begarco]

Ok, because it generates too many false positive, read will be removed from active wait functions list in i-Code 4.

[leleur]

In the version 4.0, the function "read" is still detected as COM.DESIGN.ActiveWait error.

example : RNC shell rule SH.FLOW.CheckUser