crates.io / shlex / 2.0.1

shlex 2.0.1

Source

https://github.com/comex/rust-shlex

Artifact scanned

shlex-2.0.1.crate (crate · 18.9 KB · SHA-256 f8fadd59c855…)

Compared with

shlex-2.0.0.crate (0 signals introduced since)

Files

6 scanned, 7 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.3.0

Scanned (UTC)

2026-10-24 05:18

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution src/quoting_warning.md:303:3

   [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

   ```bash
   $ echo -e 'ls a\xa0b' | bash
   ls: a: No such file or directory
   ls: b: No such file or directory

   likely benign LLM, confidence 0.93 Documentation example piping a demo command string into bash to show a non-breaking-space quoting pitfall.

   Reasoning

   The flagged pipeline is an illustrative shell transcript in a markdown document about quoting and non-breaking-space pitfalls. It demonstrates how a non-breaking space byte causes word-splitting errors. The piped data is a harmless demo string, not a payload, and the file is documentation.

2. info warn → info by review dynamic-execution src/quoting_warning.md:309:3

   [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

   ```bash
   $ echo -e 'ls a\xa0b' | bash
   ls: cannot access 'a'$'\240''b': No such file or directory
   ```

   likely benign LLM, confidence 0.93 Second documentation example of the same echo-into-bash demonstration showing quoting output.

   Reasoning

   This is the same illustrative example as the sibling finding, showing the output difference with a quoted non-breaking space. The snippet is a markdown code block in a quoting tutorial; the echo payload only prints a filename-like string and the output shown is an educational transcript.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o shlex-2.0.1.crate 'https://static.crates.io/crates/shlex/shlex-2%2E0%2E1.crate'
printf '%s  %s\n' f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba shlex-2.0.1.crate | shasum -a 256 -c -
mkdir pkg && tar -xzf shlex-2.0.1.crate -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg