SG-097: Fetch-and-Execute
Severity: MEDIUM
Network-fetched content executed as code (pipe-to-shell, process substitution, eval, render-then-run, download-then-run)
Fires when
- A remote fetch (curl/wget/fetch) is piped directly into an interpreter (sh, bash, python, ruby, perl, node, php).
- An interpreter runs a remote-fetched command substitution or eval (`bash -c "$(curl ...)"`, `eval "$(curl ...)"`), or process substitution executes a fetch (`source <(curl ...)`).
- envsubst / template output is piped into a shell (template-as-code execution).
- A remote file is downloaded then made executable or run (fetch then `chmod +x`, or fetch `-o FILE` then execution of that FILE) - the download-and-run dropper shape.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.