Skip to content

Expand unsafe paste detection to cover more common cases #799

@teamcons

Description

@teamcons

Problem

Unsafe paste concerns at the time sudo, and its more modern variant doas
However it does not cover run0, the systemD variant

It also misses common unsafe paste

Proposal

Future-proof the feature :
Include more than doas and sudo :
-"run0"
-"su"
-"pkexec"

(Do we want this ?) Include "download and run script" commands :
-Include "wget -[\S]O.* |" (anything wget -O piped to something)
-Include "curl .* |" (Anything curl piped to something)
-Rm ?
After the pipe could be matching common interpreters (sh|bash|python|fish|zsh|dash). But theres a LOT of those...
(Im not sure of my regex fu...)

Prior Art (Optional)

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions