Skip to content

Commit 3f69dad

Browse files
fix(opencode,core): close audit-v12 wave I-A shell classification findings
1 parent 1ee7d23 commit 3f69dad

4 files changed

Lines changed: 783 additions & 73 deletions

File tree

‎packages/core/src/util/wildcard.ts‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,19 @@ export function unquote(value: string) {
2323
let quote: "'" | '"' | undefined
2424
for (let index = 0; index < value.length; index++) {
2525
const char = value[index]
26+
// Bash deletes `\<newline>` line continuations before execution (`ca\<newline>t`
27+
// runs `cat`); single quotes keep the backslash, so exclude only those.
28+
if (char === "\\" && quote !== "'") {
29+
const next = value[index + 1]
30+
if (next === "\n") {
31+
index++
32+
continue
33+
}
34+
if (next === "\r" && value[index + 2] === "\n") {
35+
index += 2
36+
continue
37+
}
38+
}
2639
if (quote) {
2740
if (char === quote) {
2841
quote = undefined

‎packages/core/test/wildcard.test.ts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,13 @@ describe("Wildcard.unquote", () => {
112112
expect(Wildcard.matchStrict('"cat" notes.txt', "cat *")).toBe(true)
113113
})
114114

115+
test("deletes backslash-newline line continuations like bash", () => {
116+
expect(Wildcard.unquote("ca\\\nt")).toBe("cat")
117+
expect(Wildcard.unquote("\\\ncat")).toBe("cat")
118+
expect(Wildcard.unquote('"a\\\nb"')).toBe("ab")
119+
expect(Wildcard.unquote("'a\\\nb'")).toBe("a\\\nb")
120+
})
121+
115122
if (process.platform !== "win32") {
116123
test("unescapes backslash traversal as the shell would", () => {
117124
expect(Wildcard.unquote("..\\/etc")).toBe("../etc")

0 commit comments

Comments
 (0)