Repository navigation
Approval gate: read command substitutions (incl. unquoted heredoc bodies) and eval - #299
Merged
Merged
Conversation
From review of #298: an unquoted heredoc body is expanded by the shell, so `cat <<EOF` / `$(rm -f owner.txt)` / `EOF` ran the deletion without approval. The same held anywhere a substitution runs: `echo $(rm …)`, `"$(rm …)"`, backquotes, `<( … )` / `>( … )`, an assignment's value, inside `$(( … ))`, and `eval`. The tokenizer now collects what each command's substitutions run (also inside double quotes and unquoted heredoc bodies; a quoted or escaped delimiter keeps the body literal) and the checker reads it like any command, in that command's directory. `eval` of literal text is read the same way; of unknown text it asks. Everyday forms stay free: `$(date)`, `$(git rev-parse HEAD) > rev.txt`, `$(( 1 + 2 ))`. Tests: 22 cases; on the previous gate they fail on the reported heredoc. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T7iq5hpndSiHQcnAsywKuG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
From review of #298.
[P1] Unquoted heredocs could run commands without approval. The shell expands an unquoted heredoc body, so
$(rm -f owner.txt)or a backquoted command inside it really runs. The gate skipped the body as data.The same gap existed anywhere a substitution runs:
echo $(rm -f owner.txt)echo "$(rm -f owner.txt)"diff <(rm -f owner.txt) xand>( … )x=$(git reset --hard)$(( … ))eval "rm -f owner.txt"Fix:
cd sub && echo $(rm -f only.txt)is checked insub.evalof literal text is read the same way;evalof unknown text asks.$(date),$(git rev-parse HEAD) > rev.txt,$(( 1 + 2 )), and a heredoc with a quoted delimiter.Tests: 22 new cases (14 that must ask, 8 that must stay free). On the gate on main they fail on the reported heredoc; with the fix, all pass. The pi dialog test and
coding_agent's CI check also pass.🤖 Generated with Claude Code
https://claude.ai/code/session_01T7iq5hpndSiHQcnAsywKuG