Function CheckSemantics

tools/bash/security.go:247–275

(command string)

}

func CheckSemantics(command string) string {
	extraction := ExtractQuotedContent(command)
	target := extraction.FullyUnquoted
	for _, pattern := range commandSubstitutionPatterns[:3] {
		if pattern.re.MatchString(target) {
			return "dangerous"
		}
	}
	indicators := []*regexp.Regexp{
		regexp.MustCompile("`[^`]+`"),
		regexp.MustCompile(`\$\([^)]+\)`),
		regexp.MustCompile(`\|.*\|`),
		regexp.MustCompile(`&&.*&&`),
		regexp.MustCompile(`\|\|.*\|\|`),
	}
	score := 0
	for _, indicator := range indicators {
		if indicator.MatchString(target) {
			score++
		}
	}
	if score >= 3 {
		return "too-complex"
	}
	if score >= 1 {
		return "dangerous"
	}
	return "safe"
}

func checkCommandSubstitution(command string) []SecurityFinding {
	target := ExtractQuotedContent(command).WithDoubleQuotes