Step 1 of 4
Build multi-view quote extraction
Different attacks are visible at different stripping levels.
Implement an extraction function producing three views of every command: KEEP-DOUBLE (single-quoted content stripped, double-quoted kept - because shell metacharacters like ';' and '|' still act inside double quotes in some positions and this view exposes them), FULLY-UNQUOTED (all quoted content stripped - the view for redirection detection, since quoted '<' and '>' are inert), and KEEP-QUOTE-CHARS (content stripped but the quote characters themselves preserved - the view that reveals quote-adjacency attacks like a quoted fragment abutting a '#'). Build the underlying quote-state tracker carefully: process backslash escapes BEFORE quote toggling - inside double quotes, an escaped quote is a literal character, and toggling on it desyncs the tracker for the rest of the command. Unit-test the tracker against nasty edges: escaped quotes inside quotes, adjacent empty quotes, unterminated quotes.
Expected after this step
A tested extraction utility returning all three views with a correct state tracker.
Should not happen
- ✕Checking only the parsed token list, which is precisely what the attack bypasses
- ✕One clever regex expected to catch all quoting tricks - each family needs its own detector
- ✕A quote tracker that toggles state on escaped quotes, desyncing permanently mid-command
- ✕Treating the checks as done - obfuscation is an arms race, and the corpus is the memory
Verify before continuing
Do not move on until every check is true. The complete button stays locked until then.
Do not continue if…
- !Checking only the parsed token list, which is precisely what the attack bypasses
- !One clever regex expected to catch all quoting tricks - each family needs its own detector
- !A quote tracker that toggles state on escaped quotes, desyncing permanently mid-command
- !Treating the checks as done - obfuscation is an arms race, and the corpus is the memory
If the AI messes this up
Use this when the AI fakes progress or breaks the feature. It forces a real fix.
The tracker desyncs on a command with an escaped double quote. That is the classic ordering bug: handle the backslash first (consume the next character unconditionally outside single quotes) and only then consider quote toggling - re-run the edge-case suite after the fix.