Function extractOutputRedirections

src/utils/bash/commands.ts:634–790

(cmd: string)

 * @returns Object containing the command without redirections and the target paths if found
 */
export function extractOutputRedirections(cmd: string): {
  commandWithoutRedirections: string
  redirections: Array<{ target: string; operator: '>' | '>>' }>
  hasDangerousRedirection: boolean
} {
  const redirections: Array<{ target: string; operator: '>' | '>>' }> = []
  let hasDangerousRedirection = false

  // SECURITY: Extract heredocs BEFORE line-continuation joining AND parsing.
  // This matches splitCommandWithOperators (line 101). Quoted-heredoc bodies
  // are LITERAL text in bash (`<< 'EOF'\n${}\nEOF` — ${} is NOT expanded, and
  // `\<newline>` is NOT a continuation). But shell-quote doesn't understand
  // heredocs; it sees `${}` on line 2 as an unquoted bad substitution and throws.
  //
  // ORDER MATTERS: If we join continuations first, a quoted heredoc body
  // containing `x\<newline>DELIM` gets joined to `xDELIM` — the delimiter
  // shifts, and `> /etc/passwd` that bash executes gets swallowed into the
  // heredoc body and NEVER reaches path validation.
  //
  // Attack: `cat <<'ls'\nx\\\nls\n> /etc/passwd\nls` with Bash(cat:*)
  //   - bash: quoted heredoc → `\` is literal, body = `x\`, next `ls` closes
  //     heredoc → `> /etc/passwd` TRUNCATES the file, final `ls` runs
  //   - join-first (OLD, WRONG): `x\<NL>ls` → `xls`, delimiter search finds
  //     the LAST `ls`, body = `xls\n> /etc/passwd` → redirections:[] →
  //     /etc/passwd NEVER validated → FILE WRITE, no prompt
  //   - extract-first (NEW, matches splitCommandWithOperators): body = `x\`,
  //     `> /etc/passwd` survives → captured → path-validated
  //
  // Original attack (why extract-before-parse exists at all):
  //   `echo payload << 'EOF' > /etc/passwd\n${}\nEOF` with Bash(echo:*)
  //   - bash: quoted heredoc → ${} literal, echo writes "payload\n" to /etc/passwd
  //   - checkPathConstraints: calls THIS function on original → ${} crashes
  //     shell-quote → previously returned {redirections:[], dangerous:false}
  //     → /etc/passwd NEVER validated → FILE WRITE, no prompt.
  const { processedCommand: heredocExtracted, heredocs } = extractHeredocs(cmd)

  // SECURITY: Join line continuations AFTER heredoc extraction, BEFORE parsing.
  // Without this, `> \<newline>/etc/passwd` causes shell-quote to emit an
  // empty-string token for `\<newline>` and a separate token for the real path.
  // The extractor picks up `''` as the target; isSimpleTarget('') was vacuously
  // true (now also fixed as defense-in-depth); path.resolve(cwd,'') returns cwd
  // (always allowed). Meanwhile bash joins the continuation and writes to
  // /etc/passwd. Even backslash count = newline is a separator (not continuation).
  const processedCommand = heredocExtracted.replace(/\\+\n/g, match => {
    const backslashCount = match.length - 1
    if (backslashCount % 2 === 1) {
      return '\\'.repeat(backslashCount - 1)
    }
    return match
  })

  // Try to parse the heredoc-extracted command
  const parseResult = tryParseShellCommand(processedCommand, env => `$${env}`)

  // SECURITY: FAIL-CLOSED on parse failure. Previously returned
  // {redirections:[], hasDangerousRedirection:false} — a silent bypass.
  // If shell-quote can't parse (even after heredoc extraction), we cannot
  // verify what redirections exist. Any `>` in the command could write files.