kenryu42/cc-safety-net v2.7.4

on GitHub

This release teaches the PowerShell parser about here-strings (@'…'@ and @"…"@), which fixes both a false positive on quoted source text and several destructive commands that slipped through unchecked.

Fixed

• Fixed a false positive where the body of a PowerShell here-string was analyzed as code, so piping source text such as s = 'var x = originalArmy.Key;' through @'…'@ | python - was blocked as sensitive-path access. This applies when the command is analyzed as PowerShell — the powershell route or a powershell -Command wrapper; the auto route still denies the bare form. (#327)
• Fixed missed detections after a here-string whose body contains an apostrophe. Commands like @'…don't…'@; Remove-Item -Recurse -Force C:\ and @'…don't…'@; Get-Content id.key were allowed and are now blocked.
• Fixed detection of destructive commands handed to Invoke-Expression as a here-string.
• Improved here-string handling for carriage-return line endings and for expandable @"…"@ bodies, so a path such as $env:USERPROFILE\.ssh\config written in a here-string is resolved and blocked.
• Fixed a PowerShell double-quoted string ending in a backslash, such as Get-Content "C:\tmp\" ; Get-Content id.key, leaving the rest of the command unchecked by the secret guard.
• Allowed a here-string that only mentions a destructive command in its text, such as a Makefile body containing rm -rf piped to Set-Content.