Development record

The shell guard's tokenizer has no notion of [[ … ]]: it cuts [[ $n -gt 1 && $a == *x* && $d == "$c" ]] at each && into separate segments, so $d == "$c" ]] reads as a command whose program the line does not fix. The guard then guesses $d may be a shell (a guessed sh -c payload) and re-reads its words as a shell string with the variables' values written in, so a quoted value such as c=" >8 " becomes a redirect to a file 8. A shell run of any script later in the same script then warns script-written-then-run (a write the guard cannot place). Found on .githooks/commit-msg's is_scissors test (cut_line holds ' ------------------------ >8 ------------------------') once the hook ran check-issue-resolution.sh through bash after it; minimal repro: a script of c=" >8 ", that [[ ]] line, then bash /abs/script.sh. Traced in a debug build: payload.go's kindShell ref with guessed:true, payload '== >8 ]]', from a segment whose tokens are [<unknown> == ' >8 ' ]].