(base, command string)
| 165 | } |
| 166 | |
| 167 | func classifySensitiveRead(base, command string) *ClassifierResult { |
| 168 | switch base { |
| 169 | case "cat", "head", "tail", "less", "more", "grep", "rg", "awk", "sed": |
| 170 | default: |
| 171 | return nil |
| 172 | } |
| 173 | tokens := Tokenize(command, false) |
| 174 | for _, token := range tokens[1:] { |
| 175 | if token == "" || strings.HasPrefix(token, "-") { |
| 176 | continue |
| 177 | } |
| 178 | if _, ok := secretReadTargets[token]; ok { |
| 179 | return &ClassifierResult{CommandClass: CommandClassDangerous, SafeCommand: base, Reason: "reads process environment secrets"} |
| 180 | } |
| 181 | if _, ok := sensitiveReadTargets[token]; ok { |
| 182 | return &ClassifierResult{CommandClass: CommandClassNeedsPermission, SafeCommand: base, Reason: "reads sensitive system file"} |
| 183 | } |
| 184 | } |
| 185 | return nil |
| 186 | } |
| 187 | |
| 188 | func hasOutputRedirection(command string) bool { |
| 189 | for _, token := range Tokenize(command, false) { |
no test coverage detected