Something went wrong. Try again.
Structural ast-grep rules for Rust, Nix and Mojo, with fixture tests and a pinned Mojo grammar
Something went wrong. Try again.
661 B · 22 lines
YAML
at main
1234567891011121314151617181920212223# Command::new("sh") is the injection door the moment any argument is# assembled. The coreutils-style ports run shell strings BY SPEC, so this is# scoped to service code, where there are zero uses today - a ratchet.id: rust-shell-c-commandlanguage: rustseverity: errormessage: >- This spawns a shell. Run the target binary directly with args, or justify why shell interpretation is required here.files: - "apps/**/*.rs" - "platform/**/*.rs" - "ai/**/*.rs"ignores: - "apps/wiki/vendor/**"rule: pattern: Command::new($SH) has: field: arguments has: kind: string_literal regex: '^"(sh|bash|/bin/sh|/bin/bash|zsh|nu)"$'