Closes five detection gaps in command analysis: curl uploads of secret files, downloads piped to a shell inside unscanned bodies, live substitutions in unquoted heredocs, function keyword definitions, and PowerShell home-path spellings.
Fixed
- Fixed
curluploads that read sensitive files being allowed.-d @.env,-F file=@.env,--data-ascii,--data-binary,--data-urlencode, and<fileform parts are now blocked, including the attached (-d@.env),=-joined (--data=@.env), and clustered (-sF file=@.env) spellings.--data-raw,--form-string, and@-still pass, because they never open a file. - Fixed downloads piped to a shell going undetected inside command bodies the parser does not descend into, such as a heredoc fed to
bash.curl ... | shand itswget,nc, andaria2cvariants are now blocked, includingsudo,env,command, andbuiltinwrappers and line continuations, while benign pipes such ascurl ... | jq .stay allowed. - Fixed unquoted heredoc bodies hiding live code.
$(...)and backtick substitutions in such a body are now parsed and matched against the full rule set, socat <<EOFwith$(find . -delete)reports thefind.deleterule instead of a generic text match. Quoted (<<'EOF') bodies and escaped\$(...)remain inert data. - Fixed bash
function name { ... }andfunction name() { ... }definitions not being parsed. Commands inside such a function are now analyzed when it is called, including mutations of the protected policy file. - Fixed PowerShell secret checks missing native path spellings. A
$HOME\,$env:USERPROFILE\,$env:HOME\, or~\prefix now resolves forGet-Content,Set-Content,Add-Content,Copy-Item,Move-Item,Remove-Item, and the aliasesgc,cat,type,cp,mv,rm, anddel, and a backtick escape inside the path no longer hides it. A path assembled any other way, such as concatenation, a subexpression, orJoin-Path, stays out of scope.