@@ -57,6 +57,10 @@ describe("command-analysis risks", () => {
5757expect(detectInlineEvalArgv(["env", "-P", "/usr/bin", "python3", "-c", "print(1)"])?.flag).toBe(
5858"-c",
5959);
60+expect(detectInlineEvalArgv(["exec", "python3", "-c", "print(1)"])?.flag).toBe("-c");
61+expect(detectInlineEvalArgv(["exec", "-a", "py", "python3", "-c", "print(1)"])?.flag).toBe(
62+"-c",
63+);
6064expect(detectInlineEvalArgv(["command", "node", "--eval", "1"])?.flag).toBe("--eval");
6165expect(detectInlineEvalArgv(["env", "-S", 'python3 -c "print(1)"'])?.flag).toBe("-c");
6266expect(detectInlineEvalArgv(["python3", "script.py"])).toBeNull();
@@ -109,6 +113,12 @@ describe("command-analysis risks", () => {
109113(argv, startIndex) => argv[startIndex] === "-lc",
110114),
111115).toBe("sudo");
116+expect(
117+detectShellWrapperThroughCarrierArgv(
118+["exec", "bash", "-lc", "id"],
119+(argv, startIndex) => argv[startIndex] === "-lc",
120+),
121+).toBe("exec");
112122expect(
113123detectShellWrapperThroughCarrierArgv(
114124["sudo", "echo", "bash", "-lc", "id"],
@@ -125,6 +135,13 @@ describe("command-analysis risks", () => {
125135kind: "source",
126136command: "source",
127137});
138+expect(detectCarriedShellBuiltinArgv(["exec", "eval", "echo hi"])).toEqual({
139+kind: "eval",
140+});
141+expect(detectCarriedShellBuiltinArgv(["exec", "source", "./env.sh"])).toEqual({
142+kind: "source",
143+command: "source",
144+});
128145expect(detectCarriedShellBuiltinArgv(["command", "echo", "eval"])).toBeNull();
129146});
130147此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。