Skip to content

Pass the search filter to grep as a pattern, not as options - #102

Open
bruno-costanzo wants to merge 1 commit into
mainfrom
super-grep-option-injection
Open

bruno-costanzo wants to merge 1 commit into
mainfrom
super-grep-option-injection

Conversation

@bruno-costanzo

Copy link
Copy Markdown
Contributor

Without ripgrep, bin/super_grep ran grep -E -h "$query_regex" "$file". The filter was grep's first argument, so a filter that starts with - became grep options.

Filter -rvf gives grep -E -h -rvf app.log:

  • -f app.log: use the log lines as patterns
  • -r with no file left: search the working directory (Rails.root)
  • -v: print the lines that do not match

So the search returned every file under Rails.root (config/master.key, .env) to anyone who can open the viewer.

Fix: -e "$query_regex" in both grep calls, and -- before the file. super_ripgrep already used -e, so apps with ripgrep were not affected.

The test searches -rvf with both engines, for the whole file and for a byte range. Before the fix it returned the content of secret.txt.

Without ripgrep, a filter like -rvf reached grep as options and printed every file under Rails.root, master.key included.
@bruno-costanzo
bruno-costanzo requested a review from a team as a code owner November 6, 2026 06:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant