security(ci): the Kubescape guard's conditional screen is a second shell reader, and it keeps drifting from the first #3579

🤖 Generated by the Agentic Engineer

Evidence

scanCandidate (the screen for conditional steps) and the unconditional path read the same shell with two different, independently-maintained readers. Every bypass found in the Kubescape scan guard this week has been the same defect: the screen reads the shell less faithfully than the path it is supposed to mirror. Five of them, all on #3546, each found only after the previous one was fixed:

Four of the five were found by review, not by us, and each round found another spelling. That is the signature of enumerating a blacklist rather than closing a class: no round has converged, and there is no reason to think #5 is the last.

The problem

The screen is deliberately loose — its own doc says a false positive costs a diagnosable refusal while a false negative reopens the hole — and that is the right disposition. But "loose" was implemented as a second reader of the same language, and a second reader drifts from the first one token at a time. Every fix above closed exactly one spelling and left the asymmetry that produced it.

The security consequence is unchanged across all five: a conditional step running a reduced scan that overwrites the SARIF while an unconditional nsa,mitre invocation satisfies the validator.

What to do

Stop maintaining two readers. The screen should reach its verdict from the same tokenisation and line-joining the unconditional path already performs, and keep its looseness in the decision (what counts as a candidate) rather than in the parsing. Concretely: have scanCandidate consume the unconditional parser's view of the scalar and then apply its own permissive membership test, so a spelling the unconditional path can read is never invisible to the screen.

Acceptance criteria:

• The screen performs no shell parsing of its own — no private line-joining, no private tokenisation.
• All five regression cases above still refuse, unmodified.
• The existing controls still accept: quoted prose (echo 'ksail workload scan …'), a conditional bash -c 'echo hello', and an odd-backslash continuation.
• A property test or a shared fixture list drives both paths from one table, so a spelling added for one is automatically asserted against the other — this is the part that stops Enable GitHub OAuth for Grafana, and disable CloudFlare OAuth and Grafana NoAuth #6 existing.

Why this is filed rather than fixed in #3546

#3546 is closing the five known spellings and is nearly done; folding a parser unification into it would mix a behaviour-preserving restructure with five behaviour changes in one diff, against this repo's own rule. This is the follow-up that makes the sixth spelling impossible instead of waiting for review to find it.