From eacb22aa617df3aa190f276f576554341e1f6a2f Mon Sep 17 00:00:00 2001 From: Nuri Jung Date: Mon, 24 Nov 2025 17:02:32 +0900 Subject: [PATCH 1/4] fix(detection/terminalshell): use absolute path to shell if available --- src/detection/terminalshell/terminalshell.c | 22 +++++++++------------ 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c index 5ffae36916..878f32481b 100644 --- a/src/detection/terminalshell/terminalshell.c +++ b/src/detection/terminalshell/terminalshell.c @@ -64,12 +64,9 @@ static bool extractBashVersion(const char* line, FF_MAYBE_UNUSED uint32_t len, v return false; } -static bool getShellVersionBash(FFstrbuf* exe, FFstrbuf* exePath, FFstrbuf* version) +static bool getShellVersionBash(FFstrbuf* exe, FFstrbuf* version) { - const char* path = exePath->chars; - if (*path == '\0') - path = exe->chars; - ffBinaryExtractStrings(path, extractBashVersion, version, (uint32_t) strlen("@(#)Bash version 0.0.0(0) release GNU")); + ffBinaryExtractStrings(exe->chars, extractBashVersion, version, (uint32_t) strlen("@(#)Bash version 0.0.0(0) release GNU")); if (version->length > 0) return true; if(!getExeVersionRaw(exe, version)) @@ -230,13 +227,9 @@ static bool extractZshVersion(const char* line, FF_MAYBE_UNUSED uint32_t len, vo return false; } -static bool getShellVersionZsh(FFstrbuf* exe, FFstrbuf* exePath, FFstrbuf* version) +static bool getShellVersionZsh(FFstrbuf* exe, FFstrbuf* version) { - const char* path = exePath->chars; - if (*path == '\0') - path = exe->chars; - - ffBinaryExtractStrings(path, extractZshVersion, version, (uint32_t) strlen("zsh-0.0-0")); + ffBinaryExtractStrings(exe->chars, extractZshVersion, version, (uint32_t) strlen("zsh-0.0-0")); if (version->length) return true; return getExeVersionGeneral(exe, version); //zsh 5.9 (arm-apple-darwin21.3.0) @@ -270,10 +263,13 @@ bool fftsGetShellVersion(FFstrbuf* exe, const char* exeName, FFstrbuf* exePath, if(ffStrEqualsIgnCase(exeName, "sh")) // #849 return false; + if (exePath->length > 0) + exe = exePath; + if(ffStrEqualsIgnCase(exeName, "bash")) - return getShellVersionBash(exe, exePath, version); + return getShellVersionBash(exe, version); if(ffStrEqualsIgnCase(exeName, "zsh")) - return getShellVersionZsh(exe, exePath, version); + return getShellVersionZsh(exe, version); if(ffStrEqualsIgnCase(exeName, "fish")) return getShellVersionFish(exe, version); if(ffStrEqualsIgnCase(exeName, "pwsh")) From e914504430112c7d38ff2befbc42ded04fc29b55 Mon Sep 17 00:00:00 2001 From: Nuri Jung Date: Mon, 24 Nov 2025 20:43:45 +0900 Subject: [PATCH 2/4] fix(detection/terminalshell): use absolute path to termianl if available --- src/detection/terminalshell/terminalshell_linux.c | 5 ++++- src/detection/terminalshell/terminalshell_windows.c | 6 +++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c index e39ea9ef56..06615d9728 100644 --- a/src/detection/terminalshell/terminalshell_linux.c +++ b/src/detection/terminalshell/terminalshell_linux.c @@ -383,7 +383,10 @@ static void setTerminalInfoDetails(FFTerminalResult* result) else ffStrbufInitCopy(&result->prettyName, &result->processName); - fftsGetTerminalVersion(&result->processName, &result->exe, &result->version); + FFstrbuf *exe = &result->exe; + if (result->exePath.length != 0) + exe = &result->exePath; + fftsGetTerminalVersion(&result->processName, exe, &result->version); } #if defined(MAXPATH) diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c index 8e4e388a90..c6180b749e 100644 --- a/src/detection/terminalshell/terminalshell_windows.c +++ b/src/detection/terminalshell/terminalshell_windows.c @@ -368,7 +368,11 @@ const FFTerminalResult* ffDetectTerminal(void) if(result.processName.length > 0) { setTerminalInfoDetails(&result); - fftsGetTerminalVersion(&result.processName, &result.exe, &result.version); + + FFstrbuf *exe = &result->exe; + if (result->exePath.length != 0) + exe = &result->exePath; + fftsGetTerminalVersion(&result.processName, exe, &result.version); } return &result; From 54095cacbde5523c0bc30d2421b3ffd667401f93 Mon Sep 17 00:00:00 2001 From: Nuri Jung Date: Tue, 25 Nov 2025 09:07:09 +0900 Subject: [PATCH 3/4] fix(detection/terminalshell): apply suggestion from @Copilot Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- src/detection/terminalshell/terminalshell_windows.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c index c6180b749e..11872dc86d 100644 --- a/src/detection/terminalshell/terminalshell_windows.c +++ b/src/detection/terminalshell/terminalshell_windows.c @@ -369,9 +369,9 @@ const FFTerminalResult* ffDetectTerminal(void) { setTerminalInfoDetails(&result); - FFstrbuf *exe = &result->exe; - if (result->exePath.length != 0) - exe = &result->exePath; + FFstrbuf *exe = &result.exe; + if (result.exePath.length != 0) + exe = &result.exePath; fftsGetTerminalVersion(&result.processName, exe, &result.version); } From dc82ed270a259e142628019aa82d6b68939bb31c Mon Sep 17 00:00:00 2001 From: Nuri Jung Date: Tue, 25 Nov 2025 09:05:25 +0900 Subject: [PATCH 4/4] style(detection/terminalshell): fix indentation --- src/detection/terminalshell/terminalshell.c | 2 +- src/detection/terminalshell/terminalshell_linux.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c index 878f32481b..bd5b537ca9 100644 --- a/src/detection/terminalshell/terminalshell.c +++ b/src/detection/terminalshell/terminalshell.c @@ -264,7 +264,7 @@ bool fftsGetShellVersion(FFstrbuf* exe, const char* exeName, FFstrbuf* exePath, return false; if (exePath->length > 0) - exe = exePath; + exe = exePath; if(ffStrEqualsIgnCase(exeName, "bash")) return getShellVersionBash(exe, version); diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c index 06615d9728..e6c11dcec6 100644 --- a/src/detection/terminalshell/terminalshell_linux.c +++ b/src/detection/terminalshell/terminalshell_linux.c @@ -384,7 +384,7 @@ static void setTerminalInfoDetails(FFTerminalResult* result) ffStrbufInitCopy(&result->prettyName, &result->processName); FFstrbuf *exe = &result->exe; - if (result->exePath.length != 0) + if(result->exePath.length != 0) exe = &result->exePath; fftsGetTerminalVersion(&result->processName, exe, &result->version); }