Name-filtered find cleanups are no longer blocked as Git-metadata deletions inside a repository, and two destructive removals that hid behind a shell -c body are now blocked.
Changed
- Improved the denial message for a dangerous command passed as a positional argument to a shell wrapper: forms such as
bash -c 'exec sh -c "$1"' _ 'rm -rf /'now name the rule they violate instead of reporting an unverifiable execution source. (#143)
Fixed
- Fixed
finddeletions filtered by a literal-nameor-inamepattern being blocked as a Git-metadata deletion when no protected Git metadata entry can match that pattern, so cleanups such asfind . -name '*.pyc' -exec rm {} +run inside a Git repository again. Expressions the check cannot settle — operators, negation, unknown primaries, non-literal patterns, a recursiverm, a shell-wrapped-execbody,{}inside a longer argument, or a fixed-execdirpath — stay blocked, as do patterns that do match a metadata entry such asfind . -name '*.sample' -exec rm {} +. (#143)
Security
find -execand-execdirthat hand{}to a shell-cbody runningrmorrmdir, such asfind . -exec sh -c 'rm -rf "$0"' {} \;, are now treated as deleting the found paths. (#143)- Literal positional arguments are now substituted into a shell
-cbody before it is analyzed, sosh -c 'rm -rf "$1"' _ /is blocked as a recursive force delete of root instead of being allowed. A body with a non-literal argument is left unchanged, as before. (#143)