SG-042: Encoding Chain
Severity: HIGH
URL-encoded / JSON-unicode-escape / hex-escape / multi-layer (rot13+base64) encodings whose decoded layer carries action verbs or sensitive paths.
Fires when
- An encoded run (URL %xx / JSON \uXXXX / \xNN hex / base64) that, decoded through up to 3 layers (URL/unicode/hex/base64/rot13), yields a shell action verb (curl/wget/bash/exec/eval/chmod/sudo).
- Or that decoded layer yields an injection phrase (`ignore previous instructions`) or reveal/disclose/leak/exfiltrate wording.
- Or that decoded layer yields a credential path (~/.ssh, ~/.aws, /etc/passwd), a secret env var, or a non-local http URL.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.