From 6fd96bb1f8cc8c35cb30e557263cffec120ecfb4 Mon Sep 17 00:00:00 2001 From: Josh Wolf Date: Mon, 22 Apr 2024 21:50:37 -0400 Subject: [PATCH] ensure shbang check only checks valid shbangs Signed-off-by: Josh Wolf --- pkg/sca/sca.go | 2 +- pkg/sca/testdata/shbang-test-1-r1.apk | Bin 4845 -> 5575 bytes pkg/sca/testdata/shbang-test.yaml | 20 ++++++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/pkg/sca/sca.go b/pkg/sca/sca.go index 892bdd4e0..3c91374cb 100644 --- a/pkg/sca/sca.go +++ b/pkg/sca/sca.go @@ -583,7 +583,7 @@ func getShbang(fp fs.File) (string, error) { return "", err } - if buf[0] != '#' && buf[1] != '!' { + if buf[0] != '#' || buf[1] != '!' { return "", nil } diff --git a/pkg/sca/testdata/shbang-test-1-r1.apk b/pkg/sca/testdata/shbang-test-1-r1.apk index 61583d7b5be6822c94890575b97e9851f663072d..8f38d2adfe9c5c3db7525042285712211599ed28 100644 GIT binary patch literal 5575 zcmcJRX*d+{x5t&xCS)zUB1M+$TN8yClQpu3#8^YtFp(`nA%w`jW$gPh$rfW@3u7NU zV@$R&Gr!yazPb11eRI!?^Xfd`@AG-i_dL(xjX6(6b-^u)3XBgr>x?>c{qTrO`TCW6 zsEeE7jf$e+HkUqT*vbpLLPyxQQ||$J_oE%uy-7^$*>F2D7O?5qrl#{dNeu>UK)$ zK3cVo1GCoWKAq4_e&ZcY@R#k~#DBV;h?_vZ^UiLd4rh+cG+~Wc6YZ6*tby~C-f(YN z4oSP#k9>0G?i2gSDcziN{0%>1WS+`PO1v)V_DQ;R?eV7sSWKp9-g~3tH-^eFHAa3J zri*`H@E`mM&0Zu~kg8UAn?0#8pF6RNxi@Yy*e)Ge-0e9s|+wY&+HwE^|U|MY3ZIW)!UeNWOBNIkB zb8TBAJ@pQEk;FxlfhxX`DBcbxmHmP&^}7naVOnH+St7GYR3E+dOjo^F-xY-x!2^!o zXEBmEf8y_WW$uqvSx?FJXY)t@u-^dM=fCy@Oq~2yvi()*ipmzgnB(?k>3+5DJ-#Tt z+s=zB*P|`xzw8}&>Dkw}+8%no(LadtTYn9?XAOnD_}lkE36rs$#OfB)&VkE;sY&l@SkyaPXU&KbRC*+@KB|8~;r*Y` z8p7h!B^U?3Slbjkzrb7#dkEG4BGv{z)cI2zN zCxwggB<;NjOk(ca_tMTsE;nP4w+i4w>9F}XkvA$My0X=$*52Eijej}o%rQhgBvBM1 zbD3Sto^4=A&{|a=-A^~hdF0+$Q1s-E5?9luWEoMzU@n*~y@(=)-*N6jQi+}uwV?K# zzF=QMY2ENs%W=VpFEY^<76HM5$I0-tU+_r@nayUlGL*RZEf5KjgmWK3zn6u zOXWP|uM>?jZbvsDZF7o58HjGG@m;4cu=XJhLuFY_C1R@Q^}?DVCA(sU?^^=3A5wc* zhW|e7^Bn^ZtJ^bX167{SdR;Yf&f<8*=S-eZ8&l$qn&0cBFK<}v<(ykBIXWeLW%C#D zs?&_UK=%R7(7#po>vzDp- z8bnT%wwIrwx|(V7n~L^-FK!#7>%wKiO}96{ohB{wsrGIZ?OD8{$}qJv>I5S4z_Rdc z;m>S-nYEpC1U~uzS=;;s7F47V85o9bKw9>oSsH2QaXv>C5* zi5`r8c0xJ%I83_B)!Ej^VPGg;_`zXokW{sldoWH;syVVTAeKkAo1+?5ZE3cX0M}@C z*$OUqO3OBwoVDuekTP-KyDoX?SpfuV}N!+Rc7M@nJ)vv zO5)`!Hd@`*PDJI(jP2ua-jxC?Kb!q7eRsvZV1ummYeD$g2BPIt`n$VIAr4L!XeC-- z1%{xRF-yZ*or0OT4S4?~E%rbap|u3wJ`Bzxpr)BYvRhh`N>VB*V+cgv>-p(08Fw;| zJ=m~l)nCqsj>XQ-Zu=bR<}pvb83Yjn(ktM`Adoc)f_hUAR5o;|&AhrhwSsiu6skYa z^HR3-y(`X@WK0(%^d3-OIU!@fhOsWmyu|ee;MJfY0`jCt??U7(2cD!<*_0_J#y&a! z$cI<+aBe#jh^P386ca_ydUT_W?U-uVueJ;glO*DKJOtR^bn+&u8`Jv05%F@PeE=Q zIBLvX3t&tQ!Cn_5cn?TpB+e5Gx{PiO`K>GUzx40F6r?QvS_r(OKOtig-2nuM6#f)s zlPIWV5`;Sm{j_naaO{mE4+*#{1M+2MU>`g;emBcGxX7$-N3o!r>sA)S7i7ux<)+er z{w~72=F$o7OeARz2c!$kjd3LRBE=38f`b4`=hI2S+WLxj;Y4Qj+Mks^t&H_j#kwI} z0T~zn$`J3UV`%e&Td|SazW&M-Wp44cyqsw=_V%V&VwonEed$Q)qzk`$&-9*|7!fHa zYyPyUviSAqYP`>yAqJhlgmvpdW9E#S`eeeJ`d$Fqr75G9wz+#y4EBKq>Q(uoCJu4> z%%~Yfy5gPE>j`O^+FRzINz@^&+P1V};-I*Oo68c$VvTn85EHSdtE*laQ!Q{bN12J{ z#G!9rr{=4rNQm1(d>!7eMYJnRu$-(t#@E``q4lw#d{`=J)9FK8Z=!*Uhn3=CRpO)9 zFPo?Jr}KfFuPLeudP)-8%Kp=+@in^3v-co+L{KYNz5~j7hppA$>N1qoO04xNqi<;~ zt@_s-JJ*rU6@o*Sh*NF}#=n%)C@^?4aD>6BJ>Q^}X}n+%VuCady}g@EeTPkaz(@oy z6upB~@^OKFQrnmm;f^l4lXPtKbj3T ze_gNJz4O7qa!YG-YMIja!$cMOLWcSZn5za@Px-KwjsjVR~ z2g8o~oVH$(+~HB?Vl}D6oJof=Vx^jtmqrN#TiTaugP@|}{ssebubLEr;1hJpxg$Eg zE9Zz`g`2hbi^JS8TI^|Cx?}r@(V7;G8dZ?>?@I8iRCnh{g^VJ;;m_c;z&FQ~&n!qc zsxXI~aHJaiNevpU2CdOR-*B!WiH-myGYrE&&0(7E=$SJSTeHuWAK|XPwXp+H`+FqC z+e+L$exF75T*<{x%?X)V-kO$gmK=F)jxJC{2Uq;VOJOk!fVX}W7k*LSwuX7XDlp7XvJ!awO0H70*+sTZY2Reo)mBX%xQ~bsB_C?#Kw?s+hdr3SK$+Bs zJ>DOfdhZw=H3yyUj=Wc%Kc_c{0=s(Si|9uz7%oJEU>H~Ai08;rbF*Nll>XSU-k~qG zd)`nhz-2dFqWXWWA3fU{L+-QP2S4Cl(S!*(a!8%(j5J+9kcXbQ?=OCZl{(ej$Dw82 z$(Nzwh9*aDr-^)kWuG8u!a{_Qr&H@5?dv5tPYH;?@fr z^RG^TMQ}VirGaJdWzx`5pHGrd3Kyo%y zlw%tx_jO}DD4~Vct5~oI&&-gI=dmsk%37%7h$`GGJW13#vvdRD1urhMLNy*vmX^fH zJbW0PgT=J`y104UEQv*QOT;XJO~*XYuGVxoF2_5;wG2u?=Fq&+YMbKh6W~nVt`LnM z%}Z{`x^32NYi7KnNp29HiNB~W^4l%j(I)9pbaMWgyG1#byJU%66(1Dmi`;R&<@*Eo zn&ieAd)lqk-h3)|{9407x|aF;cWTO7^lD)%5A@<3s5TfRKtG>s^-tvQDTTOT-3g7N zt6_a4qgD)eTBTO-;DYmGx~d?zxiCtjn( zy+yBsgM}grh&s(2Mx1zBMteW_`{qePeS>&R;A_(aWkhC{`7W4g*-?P2_#b%&sVw&1 zBI^48;T$FA4Ngr}R}DfV*WK}3iqCY{whYD%^R^hn656(LL7C#mLMfrvTEudQbxOgD ziYd)VYM#f$uFp*@hlY6`EXpfHTN0$jAf>8}1JPbCNS?PWM)MK^)vIzB>JuorBHkyO znTYWdM7eO^R3n4Y^3JVzhH?;k6MPfyle%{5aYkc zK8MH#lJPyfxGC~l5dpwP+3_R-xnnKnJMh&4idh$?K0|A_jBcv5L;TE_h}=k=aEj9! z)8jGIlUqZ~TVW5@5iy1K_nXFc*+>+`W1)={le$zpZUv}`$j>E#tfK8#rP{et@J zepC}{9z%4FD19R|3cG%Fb3J%{Ghm^L(J(zV!d?_f5D=Ugk(P281i;E2LT8n^TR9^X)au{EZM^n&W*@cCr#tbH;rJ+gU6L>)7 z4Z2Lhxc5M#cFy#p9?)5Te*wVf(p`59Ch~oJ)YF2SFFvsTs0$ z)#ZzZBS+j;XH>VVLSXWEG0 zSLx|QR2%H*{6c!NwmZqa5ekyl3sQ$`eWcvAYSnfFh6Muki zKei{3f_O}-w*in?GU_)aeW6QgyQ^?5_1OJs$=3_JzwO8rUB*rj69*!+lx_X*3#c+O zzF6-(s9fIYuT-1Y%w!(^C|}{(zu%`H51749qyWYJMidx}0w!J5RF`J`A~46}T-U+r z8+AEYn*XPfqA`_#!K{zesQdU+L;*bxSRS7u#=k`=S~>pil==iimqBDaO4sig++RVH|YvIZTd?Xqv<_#c9dbQ%vL=So(&) z({OUR`Q#H9JMa~le$o3R|8Rp*%wzuuz?fA@sP$u*;{Q}&+5YI6R)yV z@%`1A5lqGjJmYxjXHz6j`G(;wwdXG-bq_U5+fDReAdCZ``gkAl0rtIUjUauMgxUmjhwe1RkiJae<(c_$?{kM) zO=NTbsa&l>(~7_ZU8?SSR4o13LzLd>lyBIPF3$0n+j0`9%ssD5YFqvDP)MXB(`npkb1oPRZB5^HFlbs6TLP_5S%$_G6haf@>fRyYl zjt(4Z?3jG?j^?SW%d92kWYaTOMY*Zx=juLj)ZEv2QkGM$Z$IqtnW^@vIm|!wvU5_% zqC*FRU(Cz2h=|DW;BH5z{9dQ41+jHznFcFW-@YT8>t@Ddg(l^^>tppevxTar&&#+O zZ5Ei$IhLY097~<-q+rW+({_?DMV(fj3T`%3AFEMqWu~{|)mDhShq>kEsPKl%m}o;b zQYhGN_?J@4f&9K{LiLQkl@al+Oo#B6im0^(&O5%&rVeqhH^csNgil`MI#--kPkQGJ$CtYQxo_WAZpa*2V1HwUPX3W>x9Z!D zw*i;!`nXKwHrLEwHfE{waMGhg$h%jv7L?&-G;=$&h;FG-@`DeviPek0Ca-9i_kYxm z)#nFQN^*!?k6s_FI!P$Fh5Pay>B&iUIa%XfS0u7rW+fWk z9}k!P?(5*~WyF)mkRYGmzBA6N^Zo{>c6AZ6AlAjX25b7)=X&Hw5e%|}v&UZAPj{&o zb_VyZu~uP1?JvaQDql%=Pk4yIUx>cA1`VuxbZJtny0z*{a}3m7Y|f$);o#wlU+rt{ zj(sRYt8&fC9#J}0KrS|Af0m|y&+^~XG$a71si?reW{=r_N0oVo>c0TQ9D_Fi literal 4845 zcmY*bc{J34znx@H2x+m)8YO#$#xAn&#xls7t?c_KQIRl0_AOhoS9W8~Flor1Ws*U* zhGC2uGxL4@-Z}4`_wK)+bM8H#<$UfHN@WItSOQ;yfa&i6vW_wQeFqXti>Z8AmHN&$ zqOC6ORZG@jOSay`c~6D%qA?#un-?v?RfJDT3wNj7?5`g-sSIA%HSj+$AAkFL-0P$M z3;hZc$tx_WygJE{FS4ora>rgV&FBIg7=YqY93Hw8<(hXBS@9QczJN)c-3U>zax)jk zCTxbl&B1i^TAWGRBx~kpy$$H6L<1@0W)1EF^E#t|6TTJ8+m}CFbjaP|_t4H4u7S(1HH{cLezJ(qD#OZQs6^ED+~h|CCm^Y7GeCmmfYA5bcitByeVyI8 z_3WGx8SBurfRwZ#1L2-g8}%spbdOC}1yFM!B#-HM5JUspae?STAff-g*mj9!|HvGaJT7?LX50k*Rb%#-a3Ztf0$XOu$X4MO#k; z{)V5AWSAn_A;;%3ns2A~GVn2NBrwqs>J(fY^^$w*e%YXUm+@Uo$is`5y*ju$r#tCt z>09kXr1Snhuu}EB)+{YiJz2f?t<6m6T;jRt)^T=@tg@`b7uPgY;6}}6Zs^7{b35bN z!(4;gY!W{%XcRChkBfMw9Ky|}J6XC8O@eA%Dl@D2v-!RnbD+>=Gtw#XJsh_IwV~ye zOLT8;o2&+|1&=-4&)rA3H?;6&&(!=lUg3&f*{{0rjIVyNxWcCXPo3?oy)UX>+147F z&vpBgxZRh{9GzkMAXNU$@JtY;8eHFa7E~wJ@*KqY|CZwneZBNGs-$Pi!FwU+yYK6o za7eRbSF`1fh?A0-{^7fr(Vu=to7aneioWU+gbzAGy0Fi%MiJ~wo#qf-W%}Dv=I`Sk zVaVpCayKS=r5|Uh=v_bt1r|U5!syYL*66d=2@JW0d$)^))lH4oX<&TgGyblzA%c=A zy`+r-5%2b8DSD2poZ1T$O4=;Z)|NIoriW6Xw;nayniGtA>bFBHE+>HoZZZGX`djpv z?o_llwc$r#u+`z(NZdR$x1BoT3v4Su>KThJEdc}G=r;NT9mdIzN$d9Lp+SZ(Tcz1mB)XuDC| zh<*?P$8IC#o9jpKH{@M!;S3fSw3Rjap(Vo1!a1?tOe5`T(k2`fUwhAAy}U zd~?&mUM0*!d(QmE@{bHpz7NT4!`UW|7P8CX93Cla^Pc~$fpMYO9X$hfGEM;dSiDF& zfH*lcdxqseRO<0V1+*fUqJ2AcQ&vOilrbz|YTQ=OlG3lpPy^4KxhQfQE_xG2+S*ccvW6Q9@{fK~eeH*K&g^emr=_7ZL@jj&>+U zqB6xYyA0O@zhCr`Hp{z5oCG9hyfX!vq9AV_D=2!9_GN40CMLBgu3);=CJtpCn9OVc zenhjlg&a@lnJ=sAku+CK2>I0O7M{QzWi)f{!wvM0nMbJFPwI#+TL(o#N<)f;@K~*& zaDbI0+6lxRl(6$&F#5EV-e`{KIaW~Wn;iE^8h)r-oK2EKww;}Q13D4FGu;yCPK3=@ zy(oCLALo@}Y=NFvNd3VX@68NT5(935N(;wb|AekFD_y;TZsB{6O5+Q_l1e9==FA5P zvD0{$!GuByquKsZs|Rv7l{_qXKOfm!Xg%~@4;}0maUqmnej!tR3Gy`EE@Nh(bkaV6 z>E4Z=N$=&i&D9vLcVf2XyfRN&_LGc>6LCLdcoGbSC%X}pW1)N6?>978(({D+C4Iqm zNKEPZCmWH)C6$c`kY!iP7lVCbUhJ$M=MoaDh!Kud%>wHkG6#C$LufiXm=fPs{{KOY z5J5)Bcn(uYcDa~9#<`?R!ubd?Fg0rUSf&qP&LAB1SEvree>a$444oMo^kn~3HA~E} z_;l?$=&$2zD7me&4oC5#ZiD97_@*Kr~OE1#B2sr$hEbup1-6XiakGYs#5u{{<5&UDlR*tqHV`cbsIxHI7h(6 zt2@ZWA!y(CPFe}7)imhtrCUWyp&SAZ{77J=tOO`g-H2~6a*3nilgQZ}La#h*LkT@6 z2jqf~Ha$?FfC(I%lO;Avtd19@Gmj?i=@;&u1a(@=EE^H*D^k$%qGve1_VyuKj6Z zByRlQ$ZLkk)4>YBRI(kEfNlwPQDZXlQ>^qB#DJ-`z5v^(B<`>3J!AOpY2P^MOk@ro zL2!c~t;h%#Ms59Ch2A-uU*A&gJ7)&lN*!zUlt3_pPG(;i4y^PvhtWYLaX3{t_6}Sg z_IQIR!CM@O%^o3olWzYX9JBt)B89#1H(9+T6<28aW#WJ(KQ?KMDvNB)ic79q;NSK& z!W5wzr@S^{!D?H3{A6}#X4I^x%9gv{7si9T8fcYtr-~zaBMvJvPbHf*+fwvMl`%Cm*6Z414Dv{zWm2%rvW!CL;TH2=BJl`^NPMcs+meL%ywZz zmbG6U(tLdYVbh&E)DTX7n&?iiyX4<4@@P$eiiN4R*XL}K2n6?_>7n(WZy{@GK z=jpn=1--7CPg^r=&WtXIDcu5Uytw00+(Kn%`=}vLVGEez7DjyUZC?@Op=7S+vf>A4 zNs1F21=HxK@D6;H$30)Mz{X}7=U$-A{0PlMXBiN%mCpfxw<6z|zB}&Bg z({wkonhtNNM*~n17Zu&~n99vSR^C39g+*UC6G1kvdCj5sug`4hmI3nBcq)g<$`e37 z8`eBg5~rSxlQYDJ6d(cK8N*J-SP3%+@TlfYmV1w|+&3Pnac?Oej$Vfh@V%_+-S{)e zY6sfqXB50~v7qeb!eY|{CI*sS@i(hk97h)bF2{e1*F;X`-M|8$gu(t8R1+B}7lt_@ zr@+;u(o)rAL|H&=3nwPX8XwKb(4$C&aey96al;%aFrwf(rtFkM;@pAM@}}+{@xE5^ z7Qyj|CaD#V86sR?F3~@HF#}XQQ|ALOmE*08bk>1NVX%qXlJ7f&sd>i3$da7l2H;jU znC*~oizi?4M1H(tSNa{rI~my;Y;8~ zQXC()(Wt66b2c<;t^kd84t_zmYJIHJt=8ON9v+})lWD8iCsK?OrSim_#wbAJ%a^Ad*Z_|TSF~foJ&;yt?G|~8< z$-@8}n}2~uO#twduvB8In;1xuH4Go04mHWN@zA`a)=;^vtkdd8ImN}Sp5m^BllI~O z8@YJEc}k3S+W3$}o%<&#vpFgWy<{=1j+h9iS7ko2cQs3AczIAE!79|}Eo7z1yxv6y zKTkS9i28CeUzPc#^;?7pOw(*6o0t}^4ad!6GL!;==0(I+`!Bm~{ha>@pNc|;2R!8hSuG~M(zy(Vt4cr}UblDQ+#?WYb0?gOeP1IU_$ z8*4!GYe257=_mf9|19!}&@qlmJ0}EyPY%GJVKY$)Ca$N)c49?f;0o%njyDyZxNd95eO7D!Qy92qWG;dua}AG3wWEvD*t;s7aYrL^6NJN#=M*RB!C?a*x0p+ zFE$%HhdB#eO@3uD9?bU9b$GU{;_92#KddF3yT4hqCIJI1elZU~!QTpUgQRqH)^V^A zJdMc5L|+ygA9bLb!;5OAR)oyg%N9GgKPC_5W#i?8R}2D-zn6a>Hfnx)bmzY7$!A*N zOvFbtQX_$$ zp{$#WzTTlM%@GM59yrV`tx1JjKk2^Z0ybh`D2r8b((5Hc8vi=DmAz7jeNNTheAk3s zTz7Gkn}R@!)2PfP`10E!d?`|>=eV!|8;OEJQvwO8CnwvNA~xU><|*0K<hX}dhuhX$8AQ* zEmQDMy0IujyiUbrcRFOJk?=Dy6>`B8Z8;@N-@CkhS0fpp*Lt{#F1g*-5_)Xhfoy-d z$IE&eTb*mmxLNe81;d&Va=j_W#N9_r>rZ|3J>RhP1$P-Tp>#buQDLvNRWQ14Jd&Yt z`1$D$?U$HK>XSbevv+pcLknjVweAevWN!{yW8hhv5q6RsmPO0OdeX43zHX5e4<*eC zWrP;3%OfPIb-PYZMS4Z4Gbk*%rRU^H`OYPCAJxrS??2dItp