Fix some command special chars

DataDog · Sep 13, 2023 · 4e3ba84 · 4e3ba84
1 parent 22c4f96
commit 4e3ba84
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/packages/dd-trace/src/appsec/plugins/child-process/scrub-cmd-params.js b/packages/dd-trace/src/appsec/plugins/child-process/scrub-cmd-params.js
@@ -60,8 +60,14 @@ function scrubChildProcessCmd (expression) {
     for (let index = 0; index < expressionTokens.length; index++) {
       const token = expressionTokens[index]
 
-      if (token.op) {
-        result.push(token.op)
+      if (typeof token === 'object') {
+        if (token.pattern) {
+          result.push(token.pattern)
+        } else if (token.op) {
+          result.push(token.op)
+        } else if (token.comment) {
+          result.push(`#${token.comment}`)
+        }
       } else if (!foundBinary) {
         if (envvarRegex.test(token)) {
           const envSplit = token.split('=')

diff --git a/packages/dd-trace/test/appsec/plugins/child-process/scrub-cmd-params.spec.js b/packages/dd-trace/test/appsec/plugins/child-process/scrub-cmd-params.spec.js
@@ -7,6 +7,20 @@ describe('scrub cmds', () => {
     expect(scrubCmdParams('ls -la')).to.be.deep.equal(['ls', '-la'])
   })
 
+  it('Should split correctly comments', () => {
+    expect(scrubCmdParams('ls #comment')).to.be.deep.equal(['ls', '#comment'])
+    expect(scrubCmdParams('ls #comment with spaces')).to.be.deep.equal(['ls', '#comment with spaces'])
+  })
+
+  it('Should split globs', () => {
+    expect(scrubCmdParams('ls node_modules/*')).to.be.deep.equal(['ls', 'node_modules/*'])
+    expect(scrubCmdParams('ls *')).to.be.deep.equal(['ls', '*'])
+  })
+
+  it('Should split correctly texts', () => {
+    expect(scrubCmdParams('echo "Hello\\ text"')).to.be.deep.equal(['echo', 'Hello\\ text'])
+  })
+
   it('Should not scrub chained command', () => {
     expect(scrubCmdParams('ls -la|grep something')).to.be.deep.equal(['ls', '-la', '|', 'grep', 'something'])
   })