fix(sast): scope curl-pipe-shell off the declarative check corpus - #21
Merged
Conversation
The generic-language rule matched the phrase "to run \`curl ... | sh\`"
inside a check description block scalar and failed the ona PR's SAST
gate (run 32213773362) — prose documenting the attack a control defends
against, in a .check.yaml file that src/check/interpreter.rs treats as
pure data (template resolution -> HTTP -> JSONPath -> CEL; no field ever
reaches a shell). Any match under checks/ is therefore false by
construction, and the in-branch "fix" of rewording the prose left the
class open: the next check that names curl|sh in its description would
re-break CI.
Exclude checks/** from this rule — the same rationale the workflow
already applies to .sscsb/rules ("a scanner must not scan its own rule
definitions") — while every executable surface (*.sh, *.bash, *.zsh,
Makefile, workflow/CI YAML) stays covered. Verified with semgrep
1.175.0: the ONA-2.02 prose no longer matches; a real curl|sh in a
shell script and in a workflow yml still does; the repo-wide ERROR
count under the gate's own excludes is zero.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016qAUyZgpei6EhKL6jXdu1C
p4gs
marked this pull request as ready for review
September 1, 2026 09:25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the one still-open defect behind the Aug 10–19 CI red streak: the
sscsb.curl-pipe-shellERROR rule (generic-language regex over*.yml/*.yaml) matches prose inside declarativechecks/**YAML. It broke the ona PR (run 32213773362) on ONA-2.02's description sentence naming thecurl | shattack the check defends against; that PR got green only by rewording the prose, which left the class open — any future check description that literally names the attack re-breaks CI.Fix: add
exclude: ["checks/**"]to the rule's paths. Check YAMLs are data interpreted bysrc/check/interpreter.rs(HTTP + CEL — no field ever reaches a shell), so a match there is false by construction; this mirrors the workflow's existing--exclude .sscsb/rulesand the npm rule's comment-guard precedent. Every executable surface (*.sh,*.bash,*.zsh,Makefile, workflow/CI YAML) keeps full coverage,--errorgating stays, and no true finding is suppressed.Verified with semgrep 1.175.0 against the edited ruleset: ONA-2.02 prose → 0 findings; a real
curl … | shin a.shfixture → still flagged; a realcurl … | bashin a workflow.ymloutsidechecks/→ still flagged; whole-repo ERROR count under the workflow's own excludes → 0.For context, the rest of that red streak was already fixed on main by PR #20 / commit 3720145 (gitleaks license gate → pinned OSS binary; RUSTSEC-2024-0436
paste→cel0.14; fuzz.yml's missing../grc-controlssibling checkout; the 14 pre-existing Semgrep findings → loaders hardening) — nothing further needed there. One structural item is left as an owner decision, not changed here: Dependabot's cargo security-update jobs have failed since 2026-03-13 becauseCargo.toml's../grc-controlspath deps can't resolve in Dependabot's isolated clone; fixing it properly means pinned git deps + granting Dependabot access to the private repo + reworking the 10 CI sibling-checkout steps, which touches credentials and org settings.AI Provenance Declaration
AI tool(s)/model(s) used (if any): Claude Code
Human review performed on AI-generated parts (what/how): None yet — this draft PR is the review vehicle. The rule-scope change was validated empirically with semgrep before/after (details above).
Dependency Changes
sscsb deps check) and approvedMerge Policy Reminder
AI involvement is declared above, so the merge to
mainneeds an approved human hardware-backed key and review evidence (Reviewed-by:trailer). Seedocs/signing.md.🤖 Generated with Claude Code
https://claude.ai/code/session_016qAUyZgpei6EhKL6jXdu1C
Generated by Claude Code