aboutsummaryrefslogtreecommitdiff
path: root/api/debug/config.php
diff options
context:
space:
mode:
authorAgando <roduccomm@gmail.com>2026-10-23 17:53:39 +0200
committerAgando <roduccomm@gmail.com>2026-10-23 17:53:39 +0200
commit2eec7a5c7ab9b724a718ece8b1ffc434677068ac (patch)
treea64817ed0aa938ecc2f75f252d6dd0d4c5587cd8 /api/debug/config.php
parent71d78fa055d00ed51a9067c441d562807ea95404 (diff)
fix(newos4): refuse shell composition, wc takes multiple paths (v4.6.58)
Packet 1 and 3 (silent wrong answers from a shell-less terminal). - detectComposition() in the security gate refuses ; && || | before dispatch. `;` used to fail loudly, but `&&`/`||` folded the right-hand side into the left command's argv (wc -l f && grep -c x f returned "42 42"), and a `|` arriving from the AI run_command tool bypassed splitPipe entirely and degraded the pattern to empty -- which matches every line. Operators inside quotes are untouched. - wc accepts multiple paths: one line per file plus a total, per-file errors for missing paths. `wc -c a b` used to print only `a` and exit 0. - help.html: "There is no shell" callout at the top of the command reference, plus the v4.6.57/58 changelog entry. Verified live on v4.6.58 by replaying the exact call sequence used by both paths: interactive `wc -c a b` -> "14 a / 10 b / 24 total"; `&&` and `;` refused; `echo "a && b"` still echoes; AI run_command semantics with `|` and `&&` refused; single command and multi-file wc still return real output.
Diffstat (limited to 'api/debug/config.php')
0 files changed, 0 insertions, 0 deletions