rubik 0.1.0

data/lib/rubik/security/classifier/models.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+module Rubik
+  module Security
+    module Classifier
+      module Classification
+        READONLY = :readonly
+        LOCAL_EFFECTS = :local_effects
+        EXTERNAL_EFFECTS = :external_effects
+        UNKNOWN = :unknown
+        DANGEROUS = :dangerous
+
+        SEVERITY_ORDER = {
+          READONLY => 0,
+          LOCAL_EFFECTS => 1,
+          EXTERNAL_EFFECTS => 2,
+          UNKNOWN => 3,
+          DANGEROUS => 4
+        }.freeze
+
+        def self.severity(classification)
+          SEVERITY_ORDER.fetch(normalize(classification), 3)
+        end
+
+        def self.max_severity(*classifications)
+          list = classifications.flatten.compact
+          return READONLY if list.empty?
+
+          list.max_by { |c| severity(c) }
+        end
+
+        def self.normalize(val)
+          return nil if val.nil?
+
+          val.to_s.downcase.to_sym
+        end
+      end
+
+      module Risk
+        LOW = :low
+        MEDIUM = :medium
+        HIGH = :high
+
+        SEVERITY_ORDER = { LOW => 0, MEDIUM => 1, HIGH => 2 }.freeze
+
+        def self.severity(risk)
+          SEVERITY_ORDER.fetch(normalize(risk), 2)
+        end
+
+        def self.max_severity(*risks)
+          list = risks.flatten.compact
+          return LOW if list.empty?
+
+          list.max_by { |r| severity(r) }
+        end
+
+        def self.normalize(val)
+          return nil if val.nil?
+
+          val.to_s.downcase.to_sym
+        end
+      end
+
+      module DelegationMode
+        REST_ARE_ARGV = :rest_are_argv
+        AFTER_SEPARATOR = :after_separator
+        TERMINATED_ARGV = :terminated_argv
+        FLAG_VALUE_IS_EXPRESSION = :flag_value_is_expression
+        ARGS_ARE_EXPRESSION = :args_are_expression
+      end
+
+      module SubcommandMode
+        HIERARCHICAL = :hierarchical
+        MATCH_ALL = :match_all
+      end
+
+      Redirect = Data.define(:operator, :target, :affects_classification) do
+        def initialize(operator:, target:, affects_classification: false)
+          super
+        end
+      end
+
+      CommandInvocation = Data.define(
+        :argv, :redirects, :position_in_pipeline, :pipeline_length,
+        :context, :operator_before, :is_background, :assignments
+      ) do
+        def initialize(argv:, redirects: [], position_in_pipeline: 0, pipeline_length: 1,
+                       context: "toplevel", operator_before: nil, is_background: false,
+                       assignments: [])
+          super
+        end
+      end
+
+      DelegationConfig = Data.define(
+        :mode, :separator, :terminator, :flag,
+        :strip_assignments, :skip_leading_positionals, :min_classification
+      ) do
+        def initialize(mode:, separator: nil, terminator: nil, flag: nil,
+                       strip_assignments: false, skip_leading_positionals: 0, min_classification: nil)
+          super
+        end
+      end
+
+      OptionDef = Data.define(
+        :takes_value, :aliases, :overrides, :risk,
+        :captures_directory, :delegates_to
+      ) do
+        def initialize(takes_value: false, aliases: [], overrides: nil, risk: nil,
+                       captures_directory: false, delegates_to: nil)
+          super
+        end
+      end
+
+      CommandDef = Data.define(
+        :command, :description, :alias_of, :aliases, :classification, :risk,
+        :global_options, :subcommands, :options, :strict,
+        :subcommand_mode, :delegates_to
+      ) do
+        def initialize(command:, description: nil, alias_of: nil, aliases: [], classification: nil, risk: nil,
+                       global_options: {}, subcommands: {}, options: {}, strict: true,
+                       subcommand_mode: :hierarchical, delegates_to: nil)
+          super
+        end
+      end
+
+      InnerCommandResult = Data.define(
+        :delegation_mode, :delegation_source, :command, :argv,
+        :classification, :risk, :matched_rule, :inner_commands,
+        :ignored_options, :remaining_options, :classification_reason,
+        :overriding_option, :options, :positionals, :redirects
+      ) do
+        # redirects: transport only — the Engine applies all redirect
+        # semantics (Engine#apply_inner_redirects); the Matcher never
+        # interprets this field.
+        def initialize(delegation_mode:, delegation_source:, command:, argv:,
+                       classification:, risk:, matched_rule: nil, inner_commands: [],
+                       ignored_options: nil, remaining_options: nil, classification_reason: nil,
+                       overriding_option: nil, options: nil, positionals: nil, redirects: [])
+          super
+        end
+      end
+
+      CommandResult = Data.define(
+        :command, :argv, :classification, :risk, :matched_rule,
+        :inner_commands, :ignored_options, :remaining_options,
+        :classification_reason, :overriding_option, :directories,
+        :write_paths, :read_paths, :options, :positionals
+      ) do
+        def initialize(command:, argv:, classification:, risk:, matched_rule: nil,
+                       inner_commands: [], ignored_options: nil, remaining_options: nil,
+                       classification_reason: nil, overriding_option: nil, directories: nil,
+                       write_paths: nil, read_paths: nil, options: nil, positionals: nil)
+          super
+        end
+      end
+
+      ExpressionResult = Data.define(
+        :expression, :classification, :risk, :directories,
+        :write_paths, :read_paths, :commands, :redirects, :parse_warnings,
+        :classification_reason
+      ) do
+        def initialize(expression:, classification:, risk:, directories: [],
+                       write_paths: [], read_paths: [], commands: [],
+                       redirects: [], parse_warnings: [], classification_reason: nil)
+          super
+        end
+      end
+    end
+  end
+end

data/lib/rubik/security/classifier/parser.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative "parsers/bash"
+require_relative "parsers/powershell"
+require_relative "../../platform"
+
+module Rubik
+  module Security
+    module Classifier
+      module Parser
+        def self.parse(expression, shell: nil)
+          is_pwsh = shell.to_s.downcase == "powershell" || shell == :pwsh || shell == :powershell
+
+          if is_pwsh
+            Parsers::PowerShell.parse(expression)
+          else
+            Parsers::Bash.parse(expression)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/security/classifier/parsers/bash.rb

@@ -0,0 +1,280 @@
+# frozen_string_literal: true
+
+require "tree_sitter_language_pack"
+require_relative "../models"
+require_relative "bash_extractors"
+
+module Rubik
+  module Security
+    module Classifier
+      module Parsers
+        class Bash
+          HEREDOC_STRUCTURE_NODES = ["<<", "<<-", "heredoc_start", "heredoc_body", "heredoc_end"].freeze
+          LIST_OPERATORS = ["&&", "||"].freeze
+
+          def self.parser
+            Thread.current[:rubik_ts_bash_parser] ||= TreeSitterLanguagePack.get_parser("bash")
+          end
+
+          def self.parse(expression)
+            new.parse(expression)
+          end
+
+          def parse(expression)
+            tree = self.class.parser.parse(expression)
+            warnings = []
+            warnings << "tree-sitter reported a syntax error in expression: #{expression.inspect}" if tree.root_node.has_error
+
+            invocations = walk_node(tree.root_node, expression, context: "toplevel", operator_before: nil)
+            [invocations, warnings]
+          end
+
+          private
+
+          def walk_node(node, expression, context:, operator_before:, pipeline_position: 0, pipeline_length: 1)
+            results = []
+            case node.kind
+            when "program"
+              results.concat(walk_children_as_list(node, expression, context: context))
+            when "list"
+              results.concat(walk_list_node(node, expression, context: context, operator_before: operator_before))
+            when "pipeline"
+              results.concat(walk_pipeline_node(node, expression, context: context, operator_before: operator_before))
+            when "command"
+              inv = BashExtractors.extract_command(
+                node, expression, context: context, operator_before: operator_before,
+                                  pipeline_position: pipeline_position, pipeline_length: pipeline_length
+              )
+              results << inv if inv
+              results.concat(extract_nested_from_command_args(node, expression))
+            when "redirected_statement"
+              results.concat(walk_redirected_statement(
+                               node, expression, context: context, operator_before: operator_before,
+                                                 pipeline_position: pipeline_position, pipeline_length: pipeline_length
+                             ))
+            when "subshell"
+              results.concat(walk_subshell(node, expression, context: "subshell", operator_before: operator_before))
+            when "command_substitution"
+              results.concat(walk_compound_inner(node, expression, context: "command_substitution"))
+            when "process_substitution"
+              results.concat(walk_compound_inner(node, expression, context: "process_substitution"))
+            when "test_command"
+              inv = BashExtractors.extract_test_command(
+                node, expression, context: context, operator_before: operator_before,
+                                  pipeline_position: pipeline_position, pipeline_length: pipeline_length
+              )
+              results << inv if inv
+            when "negated_command"
+              BashExtractors.node_children(node).each do |child|
+                next if child.kind == "!"
+
+                results.concat(walk_node(
+                                 child, expression, context: context, operator_before: operator_before,
+                                                    pipeline_position: pipeline_position, pipeline_length: pipeline_length
+                               ))
+              end
+            else
+              BashExtractors.node_children(node).each do |child|
+                results.concat(walk_node(
+                                 child, expression, context: context, operator_before: operator_before,
+                                                    pipeline_position: pipeline_position, pipeline_length: pipeline_length
+                               ))
+              end
+            end
+            results
+          end
+
+          def walk_children_as_list(node, expression, context:)
+            results = []
+            operator_before = nil
+            BashExtractors.node_children(node).each do |child|
+              if ["\n", ";", "&", ";;"].include?(child.kind)
+                if child.kind == ";"
+                  operator_before = ";"
+                elsif child.kind == "&"
+                  mark_last_background(results)
+                  operator_before = nil
+                end
+                next
+              end
+              results.concat(walk_node(child, expression, context: context, operator_before: operator_before))
+              operator_before = nil
+            end
+            results
+          end
+
+          def walk_list_node(node, expression, context:, operator_before:)
+            results = []
+            curr_op = operator_before
+            BashExtractors.node_children(node).each do |child|
+              if ["&&", "||", ";"].include?(child.kind)
+                curr_op = child.kind
+                next
+              elsif child.kind == "&"
+                mark_last_background(results)
+                curr_op = nil
+                next
+              elsif child.kind == "\n"
+                next
+              end
+              results.concat(walk_node(child, expression, context: context, operator_before: curr_op))
+              curr_op = nil
+            end
+            results
+          end
+
+          def walk_pipeline_node(node, expression, context:, operator_before:)
+            members = flatten_pipeline_members(node)
+            results = []
+            members.each_with_index do |cmd_node, i|
+              op = (i.zero? ? operator_before : nil)
+              results.concat(walk_node(
+                               cmd_node, expression, context: context, operator_before: op,
+                                                     pipeline_position: i, pipeline_length: members.size
+                             ))
+            end
+            results
+          end
+
+          def walk_redirected_statement(node, expression, context:, operator_before:, pipeline_position:, pipeline_length:)
+            redirects = BashExtractors.extract_redirects_from_node(node, expression)
+            body_node = BashExtractors.node_children(node).find do |child|
+              !["file_redirect", "heredoc_redirect", "herestring_redirect"].include?(child.kind)
+            end
+            return [] unless body_node
+
+            followers = heredoc_follower_segments(node)
+            followers_pipe_len = followers.sum do |op, child|
+              continues_pipeline?(op, child) ? flatten_pipeline_members(child).size : 0
+            end
+            pipe_len = pipeline_length + followers_pipe_len
+
+            inner = walk_node(
+              body_node, expression, context: context, operator_before: operator_before,
+                                     pipeline_position: pipeline_position, pipeline_length: pipe_len
+            )
+
+            results = []
+            redirects_attached = false
+            inner.each do |inv|
+              if !redirects_attached && inv.position_in_pipeline == pipeline_position
+                inv = inv.with(redirects: (inv.redirects + redirects))
+                redirects_attached = true
+              end
+              results << inv
+            end
+
+            results.concat(walk_heredoc_followers(
+                             followers, expression, context: context,
+                                                    pipeline_position: pipeline_position, pipeline_length: pipe_len
+                           ))
+            results
+          end
+
+          def walk_subshell(node, expression, context:, operator_before:)
+            results = []
+            BashExtractors.node_children(node).each do |child|
+              next if ["(", ")"].include?(child.kind)
+
+              results.concat(walk_node(child, expression, context: context, operator_before: operator_before))
+              operator_before = nil
+            end
+            results
+          end
+
+          def walk_compound_inner(node, expression, context:)
+            results = []
+            BashExtractors.node_children(node).each do |child|
+              next if ["$(", ")", "<(", ">(", "`"].include?(child.kind)
+
+              results.concat(walk_node(child, expression, context: context, operator_before: nil))
+            end
+            results
+          end
+
+          def extract_nested_from_command_args(node, expression)
+            results = []
+            BashExtractors.node_children(node).each do |child|
+              if child.kind == "command_name"
+                BashExtractors.node_children(child).each do |sub|
+                  results.concat(BashExtractors.find_nested_substitutions(sub, expression) do |inner_node, ctx|
+                    walk_compound_inner(inner_node, expression, context: ctx)
+                  end)
+                end
+              elsif ["file_redirect", "heredoc_redirect", "herestring_redirect", "variable_assignment"].include?(child.kind)
+                next
+              else
+                results.concat(BashExtractors.find_nested_substitutions(child, expression) do |inner_node, ctx|
+                  walk_compound_inner(inner_node, expression, context: ctx)
+                end)
+              end
+            end
+            results
+          end
+
+          def flatten_pipeline_members(node)
+            members = []
+            BashExtractors.node_children(node).each do |child|
+              next if ["|", "|&"].include?(child.kind)
+
+              if child.kind == "pipeline"
+                members.concat(flatten_pipeline_members(child))
+              else
+                members << child
+              end
+            end
+            members
+          end
+
+          def heredoc_follower_segments(node)
+            segments = []
+            heredocs = BashExtractors.node_children(node).select { |c| c.kind == "heredoc_redirect" }
+            heredocs.each do |redirect|
+              pending_op = nil
+              BashExtractors.node_children(redirect).each do |child|
+                next if HEREDOC_STRUCTURE_NODES.include?(child.kind)
+
+                if LIST_OPERATORS.include?(child.kind)
+                  pending_op = child.kind
+                  next
+                end
+                segments << [pending_op, child]
+                pending_op = nil
+              end
+            end
+            segments
+          end
+
+          def continues_pipeline?(operator, child)
+            operator.nil? && child.kind == "pipeline"
+          end
+
+          def walk_heredoc_followers(segments, expression, context:, pipeline_position:, pipeline_length:)
+            results = []
+            pos = pipeline_position
+            segments.each do |op, child|
+              if continues_pipeline?(op, child)
+                flatten_pipeline_members(child).each do |member|
+                  pos += 1
+                  results.concat(walk_node(
+                                   member, expression, context: context, operator_before: nil,
+                                                       pipeline_position: pos, pipeline_length: pipeline_length
+                                 ))
+                end
+              else
+                results.concat(walk_node(child, expression, context: context, operator_before: op))
+              end
+            end
+            results
+          end
+
+          def mark_last_background(results)
+            return if results.empty?
+
+            results[-1] = results.last.with(is_background: true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubik/security/classifier/parsers/bash_extractors.rb

@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require_relative "../models"
+
+module Rubik
+  module Security
+    module Classifier
+      module Parsers
+        module BashExtractors
+          OPERATORS = [">", ">>", "<", ">&", "&>", "&>>", "<&", "<<", "<<<"].freeze
+
+          def self.node_children(node)
+            (0...node.child_count).map { |i| node.child(i) }
+          end
+
+          def self.node_raw_text(node, expression)
+            return "" if node.nil?
+
+            expression.byteslice(node.start_byte...node.end_byte) || ""
+          end
+
+          def self.node_text(node, expression)
+            raw = node_raw_text(node, expression)
+            case node.kind
+            when "string"
+              raw.length >= 2 && raw.start_with?('"') && raw.end_with?('"') ? raw[1..-2] : raw
+            when "raw_string", "ansi_c_string"
+              if raw.length >= 3 && raw.start_with?("$'") && raw.end_with?("'")
+                raw[2..-2]
+              elsif raw.length >= 2 && raw.start_with?("'") && raw.end_with?("'")
+                raw[1..-2]
+              else
+                raw
+              end
+            when "concatenation"
+              node_children(node).map { |c| node_text(c, expression) }.join
+            else
+              raw
+            end
+          end
+
+          def self.redirect_affects_classification(operator, target)
+            return false if target == File::NULL
+            return false if operator.include?(">&") && target =~ /\A\d+\z/
+
+            return true if [">", ">>", "&>", "&>>"].include?(operator) || (operator.end_with?(">") && !operator.include?("<"))
+
+            operator.length >= 2 && operator[0] =~ /\d/ && operator.include?(">")
+          end
+
+          def self.extract_redirects_from_node(node, expression)
+            redirects = []
+            node_children(node).each do |child|
+              case child.kind
+              when "file_redirect"
+                red = parse_file_redirect(child, expression)
+                redirects << red if red
+              when "heredoc_redirect"
+                red = parse_heredoc_redirect(child, expression)
+                redirects << red if red
+              when "herestring_redirect"
+                red = parse_herestring_redirect(child, expression)
+                redirects << red if red
+              end
+            end
+            redirects
+          end
+
+          def self.parse_file_redirect(node, expression)
+            operator_parts = []
+            target = ""
+
+            node_children(node).each do |child|
+              if child.kind == "file_descriptor" || OPERATORS.include?(child.kind)
+                operator_parts << node_raw_text(child, expression)
+              elsif child.is_named
+                target = node_text(child, expression)
+              else
+                text = node_raw_text(child, expression)
+                if OPERATORS.include?(text)
+                  operator_parts << text
+                elsif target.empty?
+                  target = text
+                end
+              end
+            end
+
+            operator = operator_parts.join
+            if operator.empty?
+              full = node_raw_text(node, expression)
+              operator = full.split.first || full if full.include?(">") || full.include?("<")
+            end
+
+            affects = redirect_affects_classification(operator, target)
+            Redirect.new(operator: operator, target: target, affects_classification: affects)
+          end
+
+          def self.parse_heredoc_redirect(node, expression)
+            operator = "<<"
+            target = ""
+
+            node_children(node).each do |child|
+              if ["<<", "<<-"].include?(child.kind)
+                operator = node_raw_text(child, expression)
+              elsif child.kind == "heredoc_start"
+                target = node_raw_text(child, expression)
+              end
+            end
+
+            Redirect.new(operator: operator, target: target, affects_classification: false)
+          end
+
+          def self.parse_herestring_redirect(node, expression)
+            target = ""
+            node_children(node).each do |child|
+              next if child.kind == "<<<"
+
+              if child.is_named
+                target = node_text(child, expression)
+              else
+                t = node_raw_text(child, expression)
+                target = t if t != "<<<" && target.empty?
+              end
+            end
+
+            Redirect.new(operator: "<<<", target: target, affects_classification: false)
+          end
+
+          def self.extract_command(node, expression, context:, operator_before:, pipeline_position:, pipeline_length:)
+            argv = []
+            assignments = []
+            has_command_name = false
+
+            node_children(node).each do |child|
+              case child.kind
+              when "variable_assignment"
+                if has_command_name
+                  argv << node_text(child, expression)
+                else
+                  # Pre-command assignment (VAR="value cmd"): kept OUT of
+                  # argv (allowlist semantics key on the real command) but
+                  # captured — the Engine classifies command-shaped VALUES
+                  # as sibling invocations (GIT_SSH_COMMAND payloads).
+                  assignments << node_raw_text(child, expression)
+                end
+              when "command_name"
+                has_command_name = true
+                argv << node_text(child, expression)
+              when "file_redirect", "heredoc_redirect", "herestring_redirect", "comment"
+                next
+              else
+                argv << node_text(child, expression)
+              end
+            end
+
+            return nil if argv.empty?
+
+            redirects = extract_redirects_from_node(node, expression)
+            CommandInvocation.new(
+              argv: argv,
+              redirects: redirects,
+              position_in_pipeline: pipeline_position,
+              pipeline_length: pipeline_length,
+              context: context,
+              operator_before: operator_before,
+              is_background: false,
+              assignments: assignments
+            )
+          end
+
+          def self.extract_test_command(node, expression, context:, operator_before:, pipeline_position:, pipeline_length:)
+            argv = extract_test_tokens(node, expression)
+            return nil if argv.empty?
+
+            CommandInvocation.new(
+              argv: argv,
+              redirects: [],
+              position_in_pipeline: pipeline_position,
+              pipeline_length: pipeline_length,
+              context: context,
+              operator_before: operator_before,
+              is_background: false
+            )
+          end
+
+          def self.extract_test_tokens(node, expression)
+            tokens = []
+            node_children(node).each do |child|
+              if ["[", "[["].include?(child.kind)
+                tokens << node_raw_text(child, expression)
+              elsif ["]", "]]"].include?(child.kind)
+                next
+              elsif child.child_count.positive?
+                tokens.concat(extract_test_tokens(child, expression))
+              else
+                t = node_text(child, expression).strip
+                tokens << t unless t.empty?
+              end
+            end
+            tokens
+          end
+
+          def self.find_nested_substitutions(node, expression, &walker)
+            results = []
+            case node.kind
+            when "command_substitution"
+              results.concat(walker.call(node, "command_substitution"))
+            when "process_substitution"
+              results.concat(walker.call(node, "process_substitution"))
+            else
+              node_children(node).each do |child|
+                results.concat(find_nested_substitutions(child, expression, &walker))
+              end
+            end
+            results
+          end
+        end
+      end
+    end
+  end
+end