Skip to content

Recognize whitelisted source strings as literal arguments #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CompleteDotTech merged 1 commit into from
Oct 25, 2026
Merged

Recognize whitelisted source strings as literal arguments #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion SHA256SUMS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
7adf4d42a2e3a42873886e56420dd9240b9d44650685f69e2d4ec2f852a00640 simplegit_rce_check.py
e468499c145f67648de9cea20a08449b61348888fd2b6f0948322c7fc0c0c5c5 simplegit_rce_check.py
2 changes: 1 addition & 1 deletion simplegit_rce_check.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -343,7 +343,7 @@ def _segments(values, start, end, pairs):
def _argument_shape(values, start, end, pairs):
if start >= end:
return "missing"
if end == start + 1 and values[start] == "@string":
if end == start + 1 and values[start] in {"@string", "@simple-git", "@config", "@customArgs"}:
return "literal_string"
if values[start] in {"[", "{"} and pairs.get(start) == end - 1:
if "..." in values[start:end]:
Expand Down
3 changes: 3 additions & 0 deletions test_evidence.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,9 @@ def test_import_aliases_instances_and_direct_factory_chains(self):
self.assertEqual("clone", self.scan("const client=require('simple-git')(); client.clone(repo);")[0]["source_operation"])

def test_factory_config_and_constants_are_shapes_not_trust(self):
for value in ["simple-git", "config", "customArgs"]:
row = self.scan("import git from 'simple-git'; git().clone('" + value + "');")[0]
self.assertEqual("literal_string", row["source_argument_shapes"])
cases = [
("{config:['constant']}", "array_literal"),
("{config:request.options}", "dynamic_or_unsupported"),
Expand Down
Loading