shine-cli 2.5.0 → 2.6.0
Evidence: 2 changed. Static findings: 54 new, 51 gone. Run full: 0 changed.
50
high
50
high
Evidence
2 changed, 10 the same.
| Change | Points | Signal | What |
|---|---|---|---|
| changed | 30 → 0 | static:downloader_pattern shine-cli |
high severity downloader_pattern in build_script code: https://example.test at cli/src/apps/refresh.rs:237 with std::process::Command::new at cli/build.rs:49 A reviewer marked this a false positive in 2.5.0. |
| changed | 0 → 30 | static:exfiltration_endpoint shine-cli |
high severity exfiltration_endpoint in build_script code: transfer.sh |
Package
- Build script
- no change
- Proc macro
- no change
- links
- no change
- New dependencies
- none
Static findings
54 new, 51 gone, 185 the same. Code that only moved counts as the same.
New in 2.6.0
high shell_command build_script 4
ssh options contain whitespace and can't be passed to rsync -ecli/src/ssh/agent/transfer/argv.rs:217#!/bin/sh\u{a}shift\u{a}exec /bin/sh -c "$*"\u{a}cli/src/ssh/agent/transfer/tests.rs:375$pwsh = Get-Command pwsh.exe -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1\u{a}$shell = if ($null -ne $pwsh) {{ $pwsh.Source }} else {{ 'powershell.exe' }}\u{a}& $she…cli/src/ssh/command.rs:87powershell.exe -NoProfile -EncodedCommand {bootstrap_encoded}cli/src/ssh/command.rs:97
high secret_environment_variable build_script 3
high downloader_pattern build_script 1
https://example.test at cli/src/apps/refresh.rs:237 with std::process::Command::new at cli/build.rs:49cli/src/apps/refresh.rs:237
high environment_enumeration build_script 1
std::env::vars_oscli/src/test_support.rs:116
high exfiltration_endpoint build_script 1
transfer.shcli/src/ssh/agent/transfer/tests.rs:16
medium process_spawn build_script 12
std::process::Command::newcli/src/apps/refresh.rs:652 cli/src/env/proxy.rs:1359 cli/src/self_install/binary/tests.rs:183 cli/src/ssh/agent/transfer/tests.rs:473 cli/src/ssh/mod.rs:931 cli/src/test_support.rs:180 cli/src/test_support.rs:242 cli/src/update_check/mod.rs:395tokio::process::Command::newcli/src/ssh/agent/transfer.rs:204 cli/src/ssh/agent/transfer.rs:221 cli/src/ssh/agent/transfer/argv.rs:32tokio::process::Commandcli/src/ssh/agent/transfer/argv.rs:31
medium shell_command test 1
powershelltests/builtin_presets/sys.rs:8
low url_literal build_script 8
http://localhost:8111cli/src/core_runtime.rs:264http://localhost:8222cli/src/core_runtime.rs:278https://example.invalid/overlay.gitcli/src/env/catalog.rs:112# base\u{a}export VITE_NAME = "Shine" # display name\u{a}VITE_OWNER='Shine team' # owner\u{a}VITE_URL=https://example.test # note\u{a}EMPTY=\u{a}cli/src/env/workspace/tests.rs:228https://example.testcli/src/env/workspace/tests.rs:239VITE_API=https://api.example.test\u{a}TOKEN=unsealed\u{a}cli/src/env/workspace/tests.rs:364 cli/src/env/workspace/tests.rs:397VITE_API=http://localhost:3000\u{a}cli/src/env/workspace/tests.rs:370
low process_spawn test 2
std::process::Command::newtests/builtin_presets/shell.rs:43 tests/source_package.rs:72
low environment_enumeration build_script 1
std::env::vars_os, keys onlycli/src/test_support.rs:88
info unsafe_code build_script 20
5 unsafe blocks, functions or implscli/src/apps/install.rs:366 cli/src/env/workspace/tests.rs:44 cli/src/secret/hybrid.rs:361 cli/src/ssh/agent/transfer/tests.rs:6215 unsafe blocks, functions or implscli/src/apps/mod.rs:3234 unsafe blocks, functions or implscli/src/apps/uninstall.rs:5771 unsafe blocks, functions or implscli/src/apps/upgrade.rs:341 cli/src/env/broker/store.rs:74 cli/src/proc.rs:54 cli/src/self_install/binary/tests.rs:22 cli/src/ssh/agent/transfer/relay.rs:25 cli/src/ssh/broker/tests.rs:3049 unsafe blocks, functions or implscli/src/completion.rs:1627 unsafe blocks, functions or implscli/src/config/discovery.rs:29035 unsafe blocks, functions or implscli/src/config/load.rs:4112 unsafe blocks, functions or implscli/src/env/proxy.rs:1405 cli/src/secret/age.rs:465 cli/src/secret/mod.rs:362 cli/src/test_support.rs:877 unsafe blocks, functions or implscli/src/ssh/broker/interaction.rs:99
Gone since 2.5.0
51 findings
high shell_command build_script 17
powershellcli/src/core_runtime.rs:283 cli/src/sys/commands.rs:896$env:COMPLETE = 'powershell'cli/src/shells/mod.rs:165PowerShell should register shine completion: {powershell}cli/src/shells/mod.rs:166PowerShell should update env Path: {powershell_snippet}cli/src/shells/mod.rs:208PowerShell should have setproxy function: {powershell_snippet}cli/src/shells/mod.rs:212PowerShell wrapper should resolve through shine bin: {powershell_snippet}cli/src/shells/mod.rs:216PowerShell should expand $HOME when assigning shine bin: {powershell_snippet}cli/src/shells/mod.rs:220PowerShell should not keep $HOME as a literal path: {powershell_snippet}cli/src/shells/mod.rs:224ssh options contain whitespace and can't be passed to rsync -ecli/src/ssh/agent.rs:688#!/bin/sh\u{a}shift\u{a}exec /bin/sh -c "$*"\u{a}cli/src/ssh/agent.rs:1238$pwsh = Get-Command pwsh.exe -CommandType Application -ErrorAction SilentlyContinue | Select-Object -First 1\u{a}$shell = if ($null -ne $pwsh) {{ $pwsh.Source }} else {{ 'powershell.exe' }}\u{a}& $she…cli/src/ssh/mod.rs:714powershell.exe -NoProfile -EncodedCommand {bootstrap_encoded}cli/src/ssh/mod.rs:724powershell.execli/src/sys/commands.rs:1095powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:/tmp/init.ps1 rust yazicli/src/sys/commands.rs:1139curl --proto '=https' --tlsv1.2 -LsSf https://setup.atuin.sh | sh\u{a} load_atuin_env\u{a} status "installed" "$(atuin --version)"cli/src/sys/commands.rs:1797https://sh.rustup.rs | sh -s -- -y --no-modify-pathcli/src/sys/commands.rs:1837
high secret_environment_variable build_script 3
high downloader_pattern build_script 1
https://example.test at cli/src/apps/refresh.rs:215 with std::process::Command::new at cli/build.rs:49cli/src/apps/refresh.rs:215
high exfiltration_endpoint build_script 1
transfer.shcli/src/ssh/agent.rs:979
high yara_match persistence_locations build_script 1
Paths and keys used to persist on a developer machinecli/src/sys/commands.rs:1384
medium process_spawn build_script 5
std::process::Command::newcli/src/shells/mod.rs:283tokio::process::Commandcli/src/ssh/agent.rs:504tokio::process::Command::newcli/src/ssh/agent.rs:505 cli/src/ssh/agent.rs:787 cli/src/ssh/agent.rs:804
low url_literal build_script 7
# base\u{a}export VITE_NAME = "Shine" # display name\u{a}VITE_OWNER='Shine team' # owner\u{a}VITE_URL=https://example.test # note\u{a}EMPTY=\u{a}cli/src/env/workspace.rs:1774https://example.testcli/src/env/workspace.rs:1785VITE_API=https://api.example.test\u{a}TOKEN=unsealed\u{a}cli/src/env/workspace.rs:1912 cli/src/env/workspace.rs:1945VITE_API=http://localhost:3000\u{a}cli/src/env/workspace.rs:1918curl --proto '=https' --tlsv1.2 -LsSf https://setup.atuin.sh | sh\u{a} load_atuin_env\u{a} status "installed" "$(atuin --version)"cli/src/sys/commands.rs:1797https://sh.rustup.rs | sh -s -- -y --no-modify-pathcli/src/sys/commands.rs:1837
info unsafe_code build_script 16
10 unsafe blocks, functions or implscli/src/apps/install.rs:36730 unsafe blocks, functions or implscli/src/apps/mod.rs:6148 unsafe blocks, functions or implscli/src/apps/uninstall.rs:5563 unsafe blocks, functions or implscli/src/apps/upgrade.rs:401 cli/src/secret/mod.rs:3447 unsafe blocks, functions or implscli/src/completion.rs:16 cli/src/ssh/broker.rs:51528 unsafe blocks, functions or implscli/src/config/discovery.rs:30239 unsafe blocks, functions or implscli/src/config/load.rs:3821 unsafe blocks, functions or implscli/src/env/broker.rs:1954 unsafe blocks, functions or implscli/src/env/workspace.rs:2243 cli/src/secret/age.rs:457 cli/src/ssh/agent.rs:8542 unsafe blocks, functions or implscli/src/proc.rs:55 cli/src/self_install.rs:8006 unsafe blocks, functions or implscli/src/secret/hybrid.rs:361
Run: full
Processes 0 new, 0 gone, 52 the same
The same processes ran.
Network 0 changed, 0 the same
No change.
Files 0 changed, 0 the same
No change.
Behavior
0 new, 0 gone, 9 the same.