cmdToString 把 cmd 字段归一化成单行命令: - "ls -la" → "ls -la" - ["bash","-c","ls"] → "ls" - ["powershell","-Command","Get-Process"] → "Get-Process"
(v any)
| 147 | // - ["bash","-c","ls"] → "ls" |
| 148 | // - ["powershell","-Command","Get-Process"] → "Get-Process" |
| 149 | func cmdToString(v any) string { |
| 150 | switch t := v.(type) { |
| 151 | case string: |
| 152 | return strings.TrimSpace(t) |
| 153 | case []any: |
| 154 | parts := make([]string, len(t)) |
| 155 | for i, p := range t { |
| 156 | parts[i] = fmt.Sprint(p) |
| 157 | } |
| 158 | low := make([]string, len(parts)) |
| 159 | for i, p := range parts { |
| 160 | low[i] = strings.ToLower(p) |
| 161 | } |
| 162 | // 解开 -Command / -c 包装 |
| 163 | for i, p := range low { |
| 164 | if (p == "-command" || p == "-c") && i+1 < len(parts) { |
| 165 | rest := parts[i+1:] |
| 166 | if len(rest) == 1 { |
| 167 | return rest[0] |
| 168 | } |
| 169 | return strings.Join(rest, " ") |
| 170 | } |
| 171 | } |
| 172 | // 去掉 shell 可执行名 |
| 173 | if len(low) > 0 && contains([]string{"powershell", "pwsh", "cmd", "bash", "sh"}, low[0]) { |
| 174 | return strings.Join(parts[1:], " ") |
| 175 | } |
| 176 | return strings.Join(parts, " ") |
| 177 | case []string: |
| 178 | parts := make([]string, len(t)) |
| 179 | copy(parts, t) |
| 180 | low := make([]string, len(parts)) |
| 181 | for i, p := range parts { |
| 182 | low[i] = strings.ToLower(p) |
| 183 | } |
| 184 | for i, p := range low { |
| 185 | if (p == "-command" || p == "-c") && i+1 < len(parts) { |
| 186 | rest := parts[i+1:] |
| 187 | if len(rest) == 1 { |
| 188 | return rest[0] |
| 189 | } |
| 190 | return strings.Join(rest, " ") |
| 191 | } |
| 192 | } |
| 193 | if len(low) > 0 && contains([]string{"powershell", "pwsh", "cmd", "bash", "sh"}, low[0]) { |
| 194 | return strings.Join(parts[1:], " ") |
| 195 | } |
| 196 | return strings.Join(parts, " ") |
| 197 | } |
| 198 | return "" |
| 199 | } |
| 200 | |
| 201 | func contains(haystack []string, needle string) bool { |
| 202 | for _, s := range haystack { |