feat: snare shield, and shellcheck in CI - #19
Merged
Merged
Conversation
shield (#18) The hook stops a payload leaving; the shield stops one running. Both known execution routes fire without the user typing anything malicious, so a check that runs BEFORE the package manager means the payload never gets its trigger. 'snare shield install' wraps npm, pnpm, yarn, bun, npx and git clone in the user's shell profile. The package managers are checked against the working directory before they run; git clone scans the fresh clone and warns before you cd into it. SNARE_SKIP_SHIELD=1 bypasses. The check is deliberately bounded — config files, .vscode/tasks.json and asset magic bytes, no git walking — because it runs before every npm install. Measured at ~22ms. Two things found while testing it: - The first version gated on [ -t 1 ], so 'npm install > log 2>&1' silently skipped the check. Redirecting output is common and would have been a trivial bypass. The tty test is gone; rc files only load in interactive shells anyway, so scripts were never affected. - Uninstall left a stray blank line, so install/uninstall cycles grew the profile. It now restores the file byte-for-byte. shellcheck in CI A two-minute shellcheck pass found a guard evasion hole that eight rounds of manual review missed. It now runs on every push and pull request. CI also validates the generated shield snippet. That snippet lives inside a heredoc, so neither 'bash -n' nor shellcheck ever parses it — a deleted if-body slipped through exactly that gap during this work and was only caught by running the thing. Closes #18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #18.
snare shield— the hook stops a payload leaving; the shield stops one running. Wrapsnpm/pnpm/yarn/bun/npx(checks cwd before running) andgit clone(scans the fresh clone before you cd in). ~22ms, bounded check — no git walking.Verified live: clean dir runs, infected dir blocked with exit 1,
SNARE_SKIP_SHIELD=1bypasses, clone of an infected repo warns immediately, install/uninstall restores the profile byte-for-byte.Two bugs found by testing it, not by reading it:
[ -t 1 ], sonpm install > log 2>&1skipped the check entirely — a trivial bypass, now removedshellcheck in CI — the pass that found the guard evasion hole in #17 now runs on every push. CI also validates the generated shield snippet: it lives in a heredoc, so neither
bash -nnor shellcheck parses it, and a deleted if-body slipped through that gap during this work.