sneak/vaultik
1
0
Fork 0
Code Issues 21 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Harden the lint-guard shell scanner against silent evasions (closes #121)
check / check (pull_request) Successful in 2m46s
Details

Browse Source 
The guard test's shell scanner was weaker than its commit message
claimed. Two holes are closed.

shellCode now treats `<<` as a here-document only when it is a real
redirection: outside single and double quotes, followed by a delimiter
word. A `<<` inside a quoted string no longer opens a phantom
here-document that swallows the rest of the file, and a here-document
still open at end of file is a loud error rather than a silent
truncation.

assertLinterIsContainerised now cuts the joined line into the simple
commands the shell would run -- on `;`, `&&`, `||` and `|` -- and
requires the command that names the linter to begin with docker. So
`docker info; golangci-lint run` and `docker info || golangci-lint run`
are rejected, while script/lint-fix's `docker run ... golangci-lint`
still passes.

The scanner comment now names the inherent limits of a text scan.
Dockerfile.lint's citation is corrected from `lll` to `revive`, the
finding the recorded evidence actually named.

Model: opus-4-8
This commit is contained in:
sneak
2026-09-21 13:07:01 +00:00
parent d2a0510cb4
commit 1658fa10ac
2 changed files with 187 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile.lint
+5 -5
View File
@@ -72,11 +72,11 @@ RUN [ -n "$CHECK_EPOCH" ] || exit 1
# running, and exits 0 reporting `0 issues.` on a tree the real config
# fails. Demonstrated on this repo at this pin, recorded on
# https://git.eeqj.de/sneak/vaultik/pulls/114: with a planted
# over-length line, `script/lint` exits 1 naming the `lll` finding with
# `linters:` and exits 0 with `linterz:`. A set-but-ineffective config
# quietly falling back to defaults is precisely the false-green class
# this gate exists to eliminate, so it must not sit in the gate's own
# configuration.
# over-length line, `script/lint` exits 1 naming the `revive` finding
# with `linters:` and exits 0 with `linterz:`. A set-but-ineffective
# config quietly falling back to defaults is precisely the false-green
# class this gate exists to eliminate, so it must not sit in the gate's
# own configuration.
#
# `config verify` catches it, and it does so OFFLINE at this pinned
# version -- verified, not assumed. Under `docker run --network none`