Permalink
Comparing changes
Choose two branches to see what’s changed or to start a new pull request.
If you need to, you can also or
learn more about diff comparisons.
Open a pull request
Create a new pull request by comparing changes across two branches. If you need to, you can also .
Learn more about diff comparisons here.
...
- 2 commits
- 8 files changed
- 2 contributors
Commits on Mar 26, 2026
-
Reject VariableNames/MemberKeys in validator, add security test coverage
- Validator now explicitly rejects ${!prefix@} and ${!name[@]} instead of silently passing them through to the executor's catch-all - Add tests for ANSI-C quoting, brace expansion, indirect expansion, here-documents, and here-strings - Document --inherit-env and --allow-redirects security implications - Extract assert_rejected_with() test helper to reduce boilerplate - Pin mise tool versions Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]> -
Strip LD_PRELOAD/DYLD vars in --inherit-env, add substitution depth g…
…uard Security hardening from audit: - Strip LD_PRELOAD, LD_LIBRARY_PATH, LD_AUDIT, DYLD_INSERT_LIBRARIES, DYLD_FRAMEWORK_PATH, DYLD_LIBRARY_PATH even in --inherit-env mode to prevent arbitrary code injection via dynamic linker - Add substitution depth cap (16) in both validator and executor to prevent stack overflow from deeply nested $(...) (DoS) - Return error for arithmetic expansion $((...)) instead of silent empty - Add test coverage for sed path traversal, input redirects, compound redirects, and nested command substitution Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Loading
This comparison is taking too long to generate.
Unfortunately it looks like we can’t render this comparison for you right now. It might be too big, or there might be something weird with your repository.
You can try running this command locally to see the comparison on your machine:
git diff 0.0.7...0.0.8