diff --git a/packages/dd-trace/src/appsec/plugins/child-process/scrub-cmd-params.js b/packages/dd-trace/src/appsec/plugins/child-process/scrub-cmd-params.js index a288e14fcc0..f00bf05d12b 100644 --- a/packages/dd-trace/src/appsec/plugins/child-process/scrub-cmd-params.js +++ b/packages/dd-trace/src/appsec/plugins/child-process/scrub-cmd-params.js @@ -60,8 +60,14 @@ function scrubChildProcessCmd (expression) { for (let index = 0; index < expressionTokens.length; index++) { const token = expressionTokens[index] - if (token.op) { - result.push(token.op) + if (typeof token === 'object') { + if (token.pattern) { + result.push(token.pattern) + } else if (token.op) { + result.push(token.op) + } else if (token.comment) { + result.push(`#${token.comment}`) + } } else if (!foundBinary) { if (envvarRegex.test(token)) { const envSplit = token.split('=') diff --git a/packages/dd-trace/test/appsec/plugins/child-process/scrub-cmd-params.spec.js b/packages/dd-trace/test/appsec/plugins/child-process/scrub-cmd-params.spec.js index 8b83c0a2564..5e628b90876 100644 --- a/packages/dd-trace/test/appsec/plugins/child-process/scrub-cmd-params.spec.js +++ b/packages/dd-trace/test/appsec/plugins/child-process/scrub-cmd-params.spec.js @@ -7,6 +7,20 @@ describe('scrub cmds', () => { expect(scrubCmdParams('ls -la')).to.be.deep.equal(['ls', '-la']) }) + it('Should split correctly comments', () => { + expect(scrubCmdParams('ls #comment')).to.be.deep.equal(['ls', '#comment']) + expect(scrubCmdParams('ls #comment with spaces')).to.be.deep.equal(['ls', '#comment with spaces']) + }) + + it('Should split globs', () => { + expect(scrubCmdParams('ls node_modules/*')).to.be.deep.equal(['ls', 'node_modules/*']) + expect(scrubCmdParams('ls *')).to.be.deep.equal(['ls', '*']) + }) + + it('Should split correctly texts', () => { + expect(scrubCmdParams('echo "Hello\\ text"')).to.be.deep.equal(['echo', 'Hello\\ text']) + }) + it('Should not scrub chained command', () => { expect(scrubCmdParams('ls -la|grep something')).to.be.deep.equal(['ls', '-la', '|', 'grep', 'something']) })