Skip to content

Repository navigation

test: pin the shell-string guard refusals and capture the kill default gap #931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
REPPL merged 2 commits into from
Oct 11, 2026
Merged

test: pin the shell-string guard refusals and capture the kill default gap #931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ca1fbc9
test: pin the home refusal and the brace left as text in shell strings
REPPL Oct 11, 2026
f4cd90c
chore: capture the search a shell string's default hides from kill
REPPL Oct 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .abcd/work/issues/open/iss-2610110946486757-kill-search-in-a-string-default.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
---
schema_version: 1
id: "iss-2610110946486757"
slug: "kill-search-in-a-string-default"
severity: "minor"
category: "bug"
source: "impl-review"
found_during: "Fable review of the shell-string re-read fix (fix/guard-string-reread-gaps)"
origin: researcher-authored
production_mode: hand-written
found_at: "internal/core/guard/payload.go"
remedy: "Feed a substitution the string's own shell runs inside a default the enclosing shell wrote as text (${X:-\\$(pgrep make)}) to the string's commands as the substitution's output, as payloadInput already does for a substitution in the string's own words; one fixture per entry it reaches, watched fail first."
---

The kill-by-search guard entry allows a search inside a double-quoted shell string's default: sh -c "kill ${X:-\$(pgrep make)}" is allowed, although with X unset the string's shell runs kill $(pgrep make). The same search written straight into the string, sh -c "kill \$(pgrep make)", refuses, and so does the direct kill ${X:-$(pgrep make)}. The string's re-read takes only spellings and varLead from the written string, never the feeds of the substitutions it holds (payload.go namedPayloads, payloadInput), so the search's output never reaches kill. main allows it too; it was found by the review of the fix for iss-2610110025455728.
8 changes: 8 additions & 0 deletions internal/core/guard/unguardedvar_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -257,6 +257,14 @@ func TestRmEmptyTextInAShellStringLeads(t *testing.T) {
{`sh -c "rm -rf ${X:-\${Y}}/y"`, VerdictBlock, id},
{`sh -c "rm -rf ${X:-\${Y:-}}/y"`, VerdictBlock, id},
{`sh -c "rm -rf ${X:-\${HOME}}/y"`, VerdictAllow, ""},
// Pairing on the written text reaches the home's own entry too: the
// string deletes the home.
{`sh -c "rm -rf ${X:-\${HOME}}/"`, VerdictBlock, "rm-rf-root-or-home"},
{`sh -c "rm -rf ${X:+\${HOME}}"`, VerdictBlock, "rm-rf-root-or-home"},
// A brace the default leaves as text is not taken into a reference:
// `${X:-\$HOME}}/` hands the string `$HOME}/`, a directory under
// the working one.
{`sh -c "rm -rf ${X:-\$HOME}}/"`, VerdictAllow, ""},
{`sh -c "rm -rf ${X:?}${Y:+z}/y"`, VerdictAllow, ""},
{`sh -c "rm -rf ./${X:+x}/y"`, VerdictAllow, ""},
{`sh -c "rm -f ${X:+--force} /tmp/a"`, VerdictAllow, ""},
Expand Down
Loading