We have a requirement (on our closed network) to scan any file(s) introduced on the system for content that will do something "bad". (Bad is not the exact wording, just the intent.)
This started when I wanted to bring in Puppet files, which are text only, non-executables. Ruby interprets the text file and then ruby executes some commands. So, Puppet files are text only & not executable.
This could apply to any script file: perl, python, bash, etc.
Right now, we have to do a line-by-line code review of everything. Uggh.
A. How do I satisfy this "requirement" in a reasonable way -- even if it is just "checking a box." B. If it is not reasonably satisfyable, what are some awesome words to send to my Information Security folks to explain why this is unnecessary/ridiculous/waste of time, etc?
I will accept personal opinions or speculations, as long as they are marked as such.