{"version":"2.1.72","anchor":"tree-sitter-bash-security-analyzer-rewrite","canonical_anchor":"tree-sitter-bash-security-analyzer-rewrite","heading":"Tree-Sitter Bash Security Analyzer Rewrite","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.72\/e\/tree-sitter-bash-security-analyzer-rewrite","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.72","markdown":"### Tree-Sitter Bash Security Analyzer Rewrite\n\nThe shell command security analyzer has been significantly rewritten to use tree-sitter AST analysis instead of relying solely on string-based heuristics. When tree-sitter is available, it provides authoritative quote context analysis, compound structure detection, and dangerous pattern identification.\n\nNew security checks include:\n\n- Arithmetic expansion with variable references\n- Heredocs with unquoted delimiters (shell expansion risk)\n- Brace expansion syntax detection\n- IFS assignment (word-splitting changes)\n- Tilde expansion in assignment values\n- Unicode whitespace and control character detection\n- Zsh `~[` dynamic directory syntax\n- Shell keyword misuse detection\n\nWhen tree-sitter is unavailable, falls back to the legacy shell-quote parser with a log message: \"tree-sitter unavailable, using legacy shell-quote path\".\n\n**Evidence**\n\nNew analyzer functions (search for `\"Tree-sitter quote context is authoritative\"`, `\"Brace expansion\"`, `\"IFS assignment\"`)"}