mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-27 05:30:39 +00:00
53df22bdd2
* fix(skillscan): catch a shell behind a sudo option that takes a value `shell-curl-pipe-shell` skips a leading `sudo` and its standalone flags, but `| sudo -u deploy bash` left the matcher parked on the option value, so a remote script piped into a shell went unreported. Let a value-taking sudo option consume its value as well. * fix(skillscan): keep the sudo option branches mutually exclusive A chain of value-taking options (`curl ... | sudo -u -u -u ... cat`) matched both sudo alternatives inside the lazy repeat, so re.search explored every one-/two-token partition before the non-shell tail failed: a 211-byte input took exponential time and did not return. Excluding value-taking options from the standalone branch lets each token be consumed exactly one way, so a failing chain stays linear while `sudo -u deploy bash` and `sudo -E bash` still report. * fix(skillscan): treat `sudo -h` as taking a value in the download pipe The hand-maintained class of sudo options that take a separate value missed `-h host` (the deprecated remote-host option), so `curl … | sudo -h host bash` parked the matcher on the host name and produced no finding — the same miss shape this class exists to prevent. Add `h`, note that the class is hand-maintained, and pin every letter of it with a contract test so a dropped letter fails instead of regressing to a silent miss. Also build the repeated-option payload in the linearity regression from the module constant rather than a second inline copy, so the byte-count pin and the subprocess exercise the same string. --------- Co-authored-by: sxh313 <sxh313@users.noreply.github.com>