Permission system splits heredoc/multi-line shell commands per line, breaking Bash(prefix) allow rules

[zwj-lambda]

Environment

• qwen-code version: 0.21.13

Problem

When a shell command embeds multi-line Python via heredoc (or any newline outside quotes),
the permission system splits the command per line and evaluates each line as an independent
command. Each line's first word (e.g. import, print) is treated as a command name;
per-line prompts appear and allow rules like Bash(python *) never match the whole command,
so it can never be auto-approved.

Reproduction

1. Configure permissions.allow: ["Bash(python *)"].

2. Run in ask/auto mode:

   python - <<'PY'
   import os
   print(os.getcwd())
   PY

3. Observed: the command is split into ["python - <<'PY'", "import os", "print(os.getcwd())", "PY"];
   segments 2-3 match no allow rule and fall through to per-line ask/classifier evaluation.

Minimal repro of the splitter (logic from chunk-4S5337WV.js):

const SHELL_OPERATORS = ["&&", "||", ";;", "|&", "|", ";", "&", "\n"];
// splitCompoundCommandSegments("python - <<'PY'\nimport os\nprint(1)\nPY")
// -> ["python - <<'PY'", "import os", "print(1)", "PY"]

Root cause

In chunk-4S5337WV.js:

• splitCompoundCommandSegments treats \n as a shell operator (SHELL_OPERATORS, ~line 43255).
• The rule-evaluation path splitCompoundCommand() (~line 43342) splits the raw command
  WITHOUT stripping heredoc bodies.
• The file-operation path walkCompoundCommand() (~line 47677) calls
  splitCompoundCommandSegments(stripHeredocBodies(command)) — heredoc bodies ARE stripped there.

The two paths are inconsistent: heredoc bodies are only stripped in the file-op path, not in
the permission rule-evaluation path.

Expected

python - <<'PY' ... PY (and any command whose newlines live inside quotes or a heredoc body)
is treated as a single command, so Bash(python *) allow rules match it.

Suggested fix

Strip heredoc bodies inside splitCompoundCommand(), mirroring walkCompoundCommand().

[qwen-code-ci-bot]

✅ Qwen Triage finished — view run. See the stage comments in this thread for the result.

✅ Qwen Triage 已完成 —— 查看运行。结果见本线程中的各阶段评论。

[qwen-code-ci-bot]

Triage

• Type: bug
• Labels: type/bug, category/security, scope/shell, priority/P2
• Next: strip heredoc bodies in the permission rule-evaluation split so Bash(prefix) allow rules match heredoc commands

Analysis

• Reproduced: not executed — unattended CI does not run repro code (static review rule). Root cause confirmed by source inspection on current main.
• Confirmed (all in packages/core/src/permissions/):
  • SHELL_OPERATORS includes '\n' — rule-parser.ts:675
  • splitCompoundCommand() (rule-parser.ts:838) splits the raw command without stripping heredoc bodies; the permission manager's Bash-rule pass consumes it at permission-manager.ts:227 (evaluate), :810 (hasRelevantRules), :908 (hasMatchingAskRule)
  • walkCompoundCommand() (shell-semantics.ts:2266) splits stripHeredocBodies(command) — the file-op path and rule path are inconsistent, exactly as reported
  • evaluateCompoundCommand() takes the most restrictive verdict across segments, so unmatched heredoc-body lines (import os, print(...), PY) force per-line prompts even though python - <<'PY' matches Bash(python *)
• Failure direction: fail-closed (extra prompts; allow rules silently never match) — permissions bug, not a vulnerability.
• Not a duplicate: security: read-only shell classifier auto-approves command substitution hidden by line continuation or ${var@P} #8582/fix(core): detect line-continuation and @P shell substitutions (#8582) #8590 (line-continuation classifier) and fix(core): handle heredoc in command substitution guard #1701 (heredoc in command-substitution guard) are adjacent but distinct.
• Fix direction: strip heredoc bodies before splitting in the rule path, mirroring the file-op path. stripHeredocBodies() is module-private to shell-semantics.ts, so the fix moves/exports it for reuse in rule-parser.ts; blast radius is the 3 call sites in permission-manager.ts. Top-level newlines outside quotes/heredocs must still split. Adjacent case worth a test: unquoted multi-line $( ... ) substitutions suffer the same split.

中文说明

• 类型: bug
• 标签: type/bug, category/security, scope/shell, priority/P2
• 下一步: 在权限规则求值的命令拆分中剥离 heredoc 正文，使 Bash(prefix) allow 规则能匹配 heredoc 命令
• 复现: 未执行 —— 无人值守 CI 不运行复现代码（静态审查规则）。根因已通过对当前 main 源码的静态检查确认。
• 确认要点（均位于 packages/core/src/permissions/）：
  • SHELL_OPERATORS 包含 '\n'（rule-parser.ts:675）
  • splitCompoundCommand()（rule-parser.ts:838）拆分原始命令时不剥离 heredoc 正文；权限管理器的 Bash 规则路径在 permission-manager.ts:227（evaluate）、:810（hasRelevantRules）、:908（hasMatchingAskRule）三处调用它
  • walkCompoundCommand()（shell-semantics.ts:2266）先 stripHeredocBodies 再拆分 —— 文件操作路径与规则路径不一致，与 issue 描述完全吻合
  • evaluateCompoundCommand() 取各段中最严格的结论，因此未匹配规则的 heredoc 正文行（import os、print(...)、PY）会强制逐行弹窗，即使 python - <<'PY' 能匹配 Bash(python *)
• 失败方向: fail-closed（多余弹窗、allow 规则静默失效）—— 权限系统 bug，非安全漏洞。
• 非重复: 与 security: read-only shell classifier auto-approves command substitution hidden by line continuation or ${var@P} #8582/fix(core): detect line-continuation and @P shell substitutions (#8582) #8590（行续接分类器）、fix(core): handle heredoc in command substitution guard #1701（命令替换守卫中的 heredoc）相关但不同。
• 修复方向: 在规则路径拆分前剥离 heredoc 正文，与文件操作路径对齐。stripHeredocBodies() 目前是 shell-semantics.ts 的模块私有函数，修复需将其移动/导出供 rule-parser.ts 复用；影响面为 permission-manager.ts 的 3 个调用点。引号/heredoc 之外的顶层换行仍须拆分。建议补测相邻场景：未加引号的多行 $( ... ) 命令替换存在同样的拆分问题。

--- Qwen Code