mirror of
https://github.com/affaan-m/ECC.git
synced 2026-10-16 05:05:30 +02:00
chenhz01
ffe0e36d46
Ported from the #3051 discussion (test intent, not the old scanner): - A confidently-parsed sed invocation whose script contains no execution construct is a pure text transformation: the script operand and every file operand are data. This removes the specific false positives where file names or non-executing scripts merely containing 'git ...' were blocked. - The GNU sed `e` command (bare or with operand) and the `s` command with the `e` flag run text through the shell. Their literal fragments (the s replacement, the e operand) and any piped/redirected source are scanned as real shell source, closing the `printf x | sed 's/x/git commit --no-verify/e'` gap reported on 2026-10-09. - Anything the literal parser cannot confidently read (addresses it cannot consume, -f script files, -i suffix ambiguity, unknown options, expansion residue) falls back to today's opaque default. No behavior changes for unmodeled launchers. - shell-scan.js is untouched and remains the canonical scanner. Tests: 14 focused cases ported from the #3051 litmus set; full hook suite 801/801.