dsh-code-security 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -4,6 +4,12 @@
 
 [历史英文记录](docs/CHANGELOG.en.md)
 
+## 0.5.1（2026-10-20）
+
+- 修复审查外来仓库时可能执行对方 `.git/config` 命令的问题：所有 git 调用加上 `-c core.fsmonitor=false`，`secure_diff` 与 `secure_scan` 的 `includeUntracked` 都不再触发被扫仓库的 fsmonitor 命令
+- 修复 `filter.<驱动>.clean` 能把新增的危险行从 diff 里删掉、让检查误判「通过」的问题：diff 改用 `--attr-source=<空树>`（Git 2.40+），工作区 `.gitattributes` 不再生效，clean 过滤器既不执行也不参与内容比较；更老的 Git 退回只关闭 fsmonitor
+- 新增 4 项回归测试：fsmonitor 不执行、clean 过滤器不执行且藏不掉 `eval(input)`、`--attr-source` 参数、`includeUntracked` 的 `ls-files` 路径；同步更新既有的 argv 断言
+
 ## 0.5.0（2026-10-17）
 
 - 设置面板顶部新增「首次使用」分步引导：一次只讲一步，支持上一步/下一步/跳过，看完记在本机不再出现。

package/docs/USAGE.en.md

@@ -85,7 +85,7 @@ Policy file: `.code-security.json`.
 {"version":1,"exclude":["vendor/**","generated/**"],"ignore":[{"ruleId":"SEC-206","file":"test/**","reason":"Not security-sensitive"}],"failOn":"high"}
 ```
 
-Git runs with external diff/textconv disabled. Paths are relative to the session workspace. Staged scans read the index and only added-line findings are reported. Invalid arguments, Git refs and incomplete hunks preserve previous state.
+Git runs with external diff/textconv disabled, and the reviewed repository's own executable config is neutralised too: every git call passes `-c core.fsmonitor=false`, and diff runs with `--attr-source=<empty tree>` so the worktree `.gitattributes` no longer applies (a `filter.<driver>.clean` is neither executed nor able to rewrite the diff). `--attr-source` needs Git 2.40+; older versions fall back to disabling fsmonitor only. Paths are relative to the session workspace. Staged scans read the index and only added-line findings are reported. Invalid arguments, Git refs and incomplete hunks preserve previous state.
 
 ## Development and licenses
 

package/docs/USAGE.md

@@ -88,7 +88,7 @@ OSV 2.7.0 当前实现使用 `缓存目录/osv-scalibr/npm/all.zip`（Python 使
 }
 ```
 
-Git 输出禁用外部 diff/textconv，路径相对当前会话工作区。暂存检查读取 Git index；新增行才计入差异发现。错写参数、无效 Git ref 或不完整 diff 不会覆盖已有记录。
+Git 输出禁用外部 diff/textconv，并额外关掉被扫仓库自带的可执行配置：所有 git 调用都带 `-c core.fsmonitor=false`，diff 还用 `--attr-source=<空树>` 让 `.gitattributes` 不生效（`filter.<驱动>.clean` 既不执行、也无法改写 diff 内容）。`--attr-source` 需要 Git 2.40+，更老的版本会退回只关闭 fsmonitor 的调用。路径相对当前会话工作区。暂存检查读取 Git index；新增行才计入差异发现。错写参数、无效 Git ref 或不完整 diff 不会覆盖已有记录。
 
 ## 开发与许可
 

package/lib/audit.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { policyIgnores } from './policy.js';
-import { parseDiff, runGitDiff, scanDiff } from './diff.js';
+import { GIT_SAFE_CONFIG_ARGS, parseDiff, runGitDiff, scanDiff } from './diff.js';
 import { isExcludedPath, scanPath } from './scanner.js';
 import { mergeFindings, scanExternal } from './engines.js';
 export function sourceEngines(value, defaults) {
@@ -39,7 +39,7 @@ export async function runSourceCheck(scope, cfg, cwd, runner, engines, policy, s
                     throw new Error('增量文件超出当前工作区');
                 let text;
                 if (scope.staged) {
-                    const shown = await runner.run(['git', 'show', ':./' + file.file], { cwd, timeoutMs: 30000, signal });
+                    const shown = await runner.run(['git', ...GIT_SAFE_CONFIG_ARGS, 'show', ':./' + file.file], { cwd, timeoutMs: 30000, signal });
                     if (shown.exitCode !== 0)
                         throw new Error('无法读取暂存区文件，请刷新后重试');
                     text = shown.stdout;
@@ -67,7 +67,7 @@ export async function runSourceCheck(scope, cfg, cwd, runner, engines, policy, s
                 throw new Error('扫描期间 Git 改动已变化，请重试');
         }
         if (scope.includeUntracked && !scope.staged) {
-            const untracked = await runner.run(['git', 'ls-files', '--others', '--exclude-standard', '-z', '--', scope.target ?? '.'], { cwd, signal, timeoutMs: 30000 });
+            const untracked = await runner.run(['git', ...GIT_SAFE_CONFIG_ARGS, 'ls-files', '--others', '--exclude-standard', '-z', '--', scope.target ?? '.'], { cwd, signal, timeoutMs: 30000 });
             if (untracked.exitCode !== 0)
                 throw new Error('无法读取未跟踪文件列表');
             if (untracked.stdout && !untracked.stdout.endsWith('\0'))

package/lib/diff.d.ts

@@ -24,6 +24,13 @@ export interface DiffScanResult {
     findings: Finding[];
     diff: string;
 }
+/**
+ * 屏蔽仓库自带配置里的可执行钩子。
+ *
+ * `-c core.fsmonitor=false`：否则 `git diff` / `git ls-files --others` 会执行
+ * 被扫仓库 `.git/config` 里的 fsmonitor 命令。
+ */
+export declare const GIT_SAFE_CONFIG_ARGS: readonly string[];
 /** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
 export declare function runGitDiff(runner: ProcessRunner, cwd: string, base: string, target?: string, timeoutMs?: number, staged?: boolean): Promise<string>;
 /** 解析 unified diff，返回每个文件的新增行与新行号。 */

package/lib/diff.js

@@ -6,18 +6,56 @@
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { isExcludedPath, scanLineSet } from './scanner.js';
+/**
+ * 屏蔽仓库自带配置里的可执行钩子。
+ *
+ * `-c core.fsmonitor=false`：否则 `git diff` / `git ls-files --others` 会执行
+ * 被扫仓库 `.git/config` 里的 fsmonitor 命令。
+ */
+export const GIT_SAFE_CONFIG_ARGS = ['-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false'];
+/**
+ * 空树对象 ID：git 对空 tree 的内容做对象头哈希（"tree 0\0"）。
+ *
+ * 现算而不是写死常量，既跟随仓库的哈希算法，也不会让一串十六进制被
+ * 密钥类规则当成可疑字符串。
+ */
+function emptyTreeOidFor(format) {
+    return createHash(format).update('tree 0\u0000').digest('hex');
+}
+const emptyTreeCache = new Map();
+/**
+ * 取当前仓库的空树对象 ID，用作 `--attr-source`。
+ *
+ * 把属性查询指向空树后，被扫仓库工作区里的 `.gitattributes` 不再生效，
+ * 因此 `filter.<驱动>.clean` 不会被调用，diff 也不会被 clean 输出替换。
+ */
+async function emptyTreeOid(runner, cwd, timeoutMs) {
+    const cached = emptyTreeCache.get(cwd);
+    if (cached !== undefined)
+        return cached;
+    const result = await runner.run(['git', ...GIT_SAFE_CONFIG_ARGS, 'rev-parse', '--show-object-format'], { cwd, timeoutMs: Math.min(timeoutMs, 10000) });
+    const oid = emptyTreeOidFor(result.exitCode === 0 && /sha256/i.test(result.stdout) ? 'sha256' : 'sha1');
+    emptyTreeCache.set(cwd, oid);
+    return oid;
+}
 /** 运行 git diff（默认 HEAD，工作区未提交改动）。 */
 export async function runGitDiff(runner, cwd, base, target, timeoutMs = 30000, staged = false) {
     if (typeof base !== 'string' || base.trim() === '' || base.trim().startsWith('-') || base.includes('\0')) {
         throw new Error('参数 base 必须是非空的 Git ref，不能是 Git 命令选项。');
     }
-    const argv = ['git', 'diff'];
+    const attrSource = '--attr-source=' + await emptyTreeOid(runner, cwd, timeoutMs);
+    const argv = ['git', ...GIT_SAFE_CONFIG_ARGS, attrSource, 'diff'];
     if (staged)
         argv.push('--cached');
     argv.push('--no-ext-diff', '--no-textconv', '--no-color', '--relative', '--src-prefix=a/', '--dst-prefix=b/', '--unified=3', '--output-indicator-new=+', '--output-indicator-old=-', '--output-indicator-context= ', base.trim(), '--');
     if (target !== undefined && target.trim() !== '')
         argv.push(target.trim());
-    const result = await runner.run(argv, { timeoutMs, cwd });
+    let result = await runner.run(argv, { timeoutMs, cwd });
+    // git < 2.40 不认识 --attr-source：退回只关闭 fsmonitor 的调用（filter 加固缺席，
+    // 但不会因此拒绝整个扫描）。
+    if (result.exitCode !== 0 && /attr-source/i.test(result.stderr)) {
+        result = await runner.run(argv.filter((arg) => arg !== attrSource), { timeoutMs, cwd });
+    }
     if (result.exitCode !== 0 && result.exitCode !== 1) {
         throw new Error('git diff 失败（退出码 ' + String(result.exitCode) + '）：' + result.stderr.trim().split(/\r?\n/).slice(-4).join(' | '));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-code-security",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "对代码与 Git 改动进行本地静态安全检查，并追踪修复结果。",
   "type": "module",
   "main": "lib/index.js",