Repository navigation
E2 shell arm: known limits of the grep -v exemption after #483 #818
Description
After #483 the E2 shell arm reports env | grep <secret name> across grep flags and quoting, and exempts a grep that inverts the match (-v), since that is redaction. The exemption reads grep's arguments with a regex and not with grep's option parser, so some spellings are read differently from how grep reads them. #483 leaves the ones below out on purpose. This issue tracks them.
1. Modes that print no value are reported (from @rng1995's review of df9128e)
if env | grep -q "^GITHUB_TOKEN="; then ...env | grep -c TOKENenv | grep -l SECRETenv | grep --quiet SECRET
These are clean on main and reported with #483. None prints a secret value. main already reports the > /dev/null spelling of the same presence check, so the open question is whether a presence check on the environment counts as harvesting. If it does not, -q/--quiet/--silent, -c/--count, -l and -L would be exempt the way -v is.
2. A -- in front of the pattern is not carried into the check after it
env | grep -- SECRET - -venv | grep -- SECRET /dev/stdin -v
After -- the -v is a file name and - or /dev/stdin names the pipe, so grep prints the secret line. Both scan clean, on main as well.
3. An over-report that follows from the rule in #483
An option that takes a value consumes the next word. env | grep SECRET -m -v is therefore reported, although grep rejects the command, and so is env | grep SECRET --label -- -v, where -- is the label and grep does invert.
4. An escaped quote inside a double-quoted pattern ends the scan (from Copilot's review of 28fb783)
env | grep -E "prefix\"SECRET"
This one is not about -v. A quoted pattern is scanned up to the next quote character, escaped or not, so the SECRET after \" is not reached. It scans clean, on main as well.
A possible direction for all four: split the command with shlex and walk the words with a table of grep's options, in place of a longer regex.
Activity
MandoCodes1 commentedon Oct 26, 2026
More cases from the round on
ee943ccof #483, left out of that PR on purpose.5. Abbreviations of
--regexpare not recognizedenv | grep -e SECRET --reg -venv | grep --reg -v -e SECRETenv | grep --rege=TOKEN -igrep expands
--regand--regeto--regexp, so the-vis a pattern and grep prints the secret line. All three scan clean, onmainand at28fb783as well.6. A quoted
-vafter--env | grep -- SECRET '-v' -env | grep -i -- SECRET "-v" -env | grep -E -- 'KEY|TOKEN' '-v' -After
--the-vis a file name. grep reads the pipe through-, prints the secret line, then exits 2 on the missing file. These scan clean, as onmain; they were reported at28fb783, before the quoted check was added. It is the quoted half of item 2.7. A quoted
-vfurther from the pattern is not read as inversionenv | grep SECRET -i '-v'env | grep SECRET --lab -v '-v'Both greps invert and print no secret, but these are reported. The quoted check looks only at the word right after the pattern, because further on a quoted
-vcan be the operand of a quoted option (env | grep SECRET '--label' '-v').8. Partial quoting and escapes
env | grep SECRET ''-venv | grep SECRET \-vThe shell hands grep a plain
-v, so grep inverts, but these are reported.