(command string)
| 129 | } |
| 130 | |
| 131 | func extractClassifierBaseCommand(command string) (string, string, bool) { |
| 132 | cleaned := StripAllSafeEnvPrefixes(strings.TrimSpace(command)) |
| 133 | tokens := Tokenize(cleaned, false) |
| 134 | var filtered []string |
| 135 | for _, token := range tokens { |
| 136 | if _, stop := commandStopTokens[token]; stop { |
| 137 | break |
| 138 | } |
| 139 | filtered = append(filtered, token) |
| 140 | } |
| 141 | if len(filtered) == 0 { |
| 142 | return "", "", false |
| 143 | } |
| 144 | _, hasSudo := privilegePrefixes[filtered[0]] |
| 145 | idx := 0 |
| 146 | if hasSudo { |
| 147 | idx = 1 |
| 148 | } |
| 149 | if idx >= len(filtered) { |
| 150 | return "", "", hasSudo |
| 151 | } |
| 152 | baseToken := filtered[idx] |
| 153 | base := baseToken |
| 154 | if !strings.Contains(baseToken, "=") { |
| 155 | base = ExtractBaseCommand(cleaned) |
| 156 | if base == "" { |
| 157 | base = NormalizeBaseToken(baseToken) |
| 158 | } |
| 159 | } |
| 160 | subcommand := "" |
| 161 | if idx+1 < len(filtered) { |
| 162 | subcommand = filtered[idx+1] |
| 163 | } |
| 164 | return base, subcommand, hasSudo |
| 165 | } |
| 166 | |
| 167 | func classifySensitiveRead(base, command string) *ClassifierResult { |
| 168 | switch base { |
no test coverage detected