Fixes a false denial where a quoted heredoc passed to a data sink was scanned as shell text whenever a wrapper or environment assignment preceded the sink.
Changed
- Changed how
CC_SAFETY_NET_PROJECT_TIGHTEN_ONLY=1applies to the heredoc fix below: onlytransparent_wrappersdeclared in your own user policy relax it, so a wrapper declared solely by a repository policy keeps the heredoc body scanned.
Fixed
- Fixed quoted heredocs being read as shell text when a wrapper or environment assignment sits in front of the data sink. A message or file body passed to
cat,tee,git commit, orgh pr|issue createbehindnohup,time,command,env,sudo, a bare assignment such asX=1, or a declaredtransparent_wrappersentry is now treated as data, so naming a path like.env.testin a commit message no longer triggers a secret block. (#346, #347)- Wrapper options are still not skipped, so forms a shell can execute — such as
nohup sh <<'EOF',nohup cat <<'EOF' | sh, andenv -S 'sh -s' cat <<'EOF'— remain blocked when the body reads a secret file.
- Wrapper options are still not skipped, so forms a shell can execute — such as