3 Commits

Author SHA1 Message Date
Teknium 6178e9f4ee fix(approvals): honor GNU env split escapes and argv0 operands 2026-09-07 14:30:41 -07:00
Teknium 50617d1c75 fix(approvals): preserve env argv and shell comment boundaries 2026-09-07 14:30:41 -07:00
Teknium 58faa10134 fix(approvals): match denied executable paths behind shell prefixes
Adapt the command-position, bounded-candidate and launcher-option work from
embwl0x's #76063 to the current detection owner, then add executable basename
projection from Rohith Pariki's #104338. Parse raw quote state before applying
existing text normalization so quoted arguments do not become commands.

Cover shell payloads and literal env split-string carriers, retain path-specific
rules and whole-command globs, and document the supported normalization rather
than claiming an OS capability sandbox. Related: #104308, #76037, #76063,
#104338, #78521, #86711. No automatic closing directives: the older carriers
also contain broader case syntax and git-option work not included here.

Co-authored-by: embwl0x <embwl0x@users.noreply.github.com>
Co-authored-by: Rohith Pariki <rohithpariki@gmail.com>
2026-09-07 14:30:41 -07:00