Semantic Parsing of Commands

A blacklist of keywords fails to cope with the combinatorial explosion of Shell commands: the ban is bypassed through pipelines, nested shells, variable expansion ($ (echo rm) -rf /). Semantic parsing is needed: to understand the types of arguments for each command and the rules for their consumption, to recognize patterns like “a harmless flag consumes the next argument, hiding a dangerous payload” (find -exec rm; curl -o /etc/crontab). This is an advanced implementation of “limiting": understanding, not pattern matching.

Related: [Five Harness Functions], [Deadly Triad], [Seven Basic Tools]