Function walkArithmetic

src/utils/bash/ast.ts:1675–1702

* Recursively validate an arithmetic_expansion node. Allows only literal * numeric expressions — no variables, no substitutions. Returns null if * safe, or a too-complex result if not. * * Variables are rejected because bash arithmetic recursively evaluates * variable values: if x='a[$(cmd)]' t

(node: Node)

 * won't match any sensitive path/deny patterns.
 */
function walkArithmetic(node: Node): ParseForSecurityResult | null {
  for (const child of node.children) {
    if (!child) continue
    if (child.children.length === 0) {
      if (!ARITH_LEAF_RE.test(child.text)) {
        return {
          kind: 'too-complex',
          reason: `Arithmetic expansion references variable or non-literal: ${child.text}`,
          nodeType: 'arithmetic_expansion',
        }
      }
      continue
    }
    switch (child.type) {
      case 'binary_expression':
      case 'unary_expression':
      case 'ternary_expression':
      case 'parenthesized_expression': {
        const err = walkArithmetic(child)
        if (err) return err
        break
      }
      default:
        return tooComplex(child)
    }
  }
  return null
}

/**
 * Check if a command_substitution node is exactly `$(cat <<'DELIM'...DELIM)`