From 34117a77162bee78e265235ed0294caf63882887 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 31 Aug 2026 22:31:43 +0000 Subject: [PATCH] fix(sast): scope curl-pipe-shell off the declarative check corpus MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The generic-language rule matched the phrase "to run \`curl ... | sh\`" inside a check description block scalar and failed the ona PR's SAST gate (run 32213773362) — prose documenting the attack a control defends against, in a .check.yaml file that src/check/interpreter.rs treats as pure data (template resolution -> HTTP -> JSONPath -> CEL; no field ever reaches a shell). Any match under checks/ is therefore false by construction, and the in-branch "fix" of rewording the prose left the class open: the next check that names curl|sh in its description would re-break CI. Exclude checks/** from this rule — the same rationale the workflow already applies to .sscsb/rules ("a scanner must not scan its own rule definitions") — while every executable surface (*.sh, *.bash, *.zsh, Makefile, workflow/CI YAML) stays covered. Verified with semgrep 1.175.0: the ONA-2.02 prose no longer matches; a real curl|sh in a shell script and in a workflow yml still does; the repo-wide ERROR count under the gate's own excludes is zero. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_016qAUyZgpei6EhKL6jXdu1C --- .sscsb/rules/sscsb-default.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.sscsb/rules/sscsb-default.yaml b/.sscsb/rules/sscsb-default.yaml index d3a45ab..ab0d8f6 100644 --- a/.sscsb/rules/sscsb-default.yaml +++ b/.sscsb/rules/sscsb-default.yaml @@ -15,6 +15,14 @@ rules: - pattern-regex: 'wget[^|;\n]*\|\s*(sudo\s+)?(ba|z|da)?sh' paths: include: ["*.sh", "*.bash", "*.zsh", "Makefile", "*.yml", "*.yaml"] + # checks/ holds declarative .check.yaml data interpreted by + # src/check/interpreter.rs (HTTP + CEL — no field ever reaches a shell), + # and its description prose legitimately NAMES attacks like `curl | sh` + # when documenting what a control defends against. A match there is false + # by construction — same rationale as the workflow's .sscsb/rules + # exclusion — while every executable surface stays covered. Broke the + # ona PR (run 32213773362) on exactly such prose. + exclude: ["checks/**"] - id: sscsb.git-protocol-insecure languages: [generic]