Skip to content

FIX: Detect command substitution execution in ShellCommandOutputScorer #3687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Roman Lutz (romanlutz) merged 20 commits into from
Nov 3, 2026
Merged

FIX: Detect command substitution execution in ShellCommandOutputScorer #3687

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
6f34b2a
FIX: Detect command substitution execution in ShellCommandOutputScorer
bIackr0se Oct 30, 2026
5aa22f3
FIX: Allow an absolute path before the fetcher in command substitution
bIackr0se Oct 31, 2026
9a195dd
Merge upstream main into fix/shell-command-substitution
romanlutz Nov 2, 2026
21322c3
FIX: Match command substitution only when the downloaded body runs
bIackr0se Nov 2, 2026
57317bd
FIX: Require a URL and read curl and wget output options as the shell…
bIackr0se Nov 2, 2026
6bd0486
Merge upstream main into fix/shell-command-substitution
romanlutz Nov 2, 2026
a35a7c3
FIX: Read curl and wget operands and quoted options as the shell does
bIackr0se Nov 2, 2026
7c9aba5
FIX: Read quoted option words as the shell joins them
bIackr0se Nov 2, 2026
516343e
FIX: Check curl option letters and numeric operands
bIackr0se Nov 2, 2026
e01dd5f
FIX: Check curl numbers by option and reject non-GET requests
bIackr0se Nov 2, 2026
00d9f72
FIX: Bound curl numeric operands and read quoted GET
bIackr0se Nov 2, 2026
88a45c6
Wrap two long pattern lines
bIackr0se Nov 2, 2026
85c329d
FIX: Bound curl fraction digits
bIackr0se Nov 2, 2026
bfce07d
Merge remote-tracking branch 'fork/fix/shell-command-substitution' in…
bIackr0se Nov 2, 2026
a8db1d4
Keep request-changing curl options detectable and read every option o…
bIackr0se Nov 2, 2026
96bee70
Check curl request bodies and URLs per transfer at --next
bIackr0se Nov 2, 2026
c81b49f
FIX: Normalize escaped shell download options
romanlutz Nov 3, 2026
56a0236
Merge upstream main into fix/shell-command-substitution
romanlutz Nov 3, 2026
1d9aeb0
Merge upstream main and isolate normalization timing
romanlutz Nov 3, 2026
c5f50e3
Merge upstream main timing-test correction
romanlutz Nov 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Loading