aboutsummaryrefslogtreecommitdiff
path: root/modules/core/module-system.js
diff options
context:
space:
mode:
authorAgando <roduccomm@gmail.com>2026-10-23 17:53:39 +0200
committerAgando <roduccomm@gmail.com>2026-10-23 17:53:39 +0200
commit9ae724e87a6471ce503783615ef6083d991531ce (patch)
treeda5523a5c8d3550c4236ead87cf878067a9cedbe /modules/core/module-system.js
parent83e64b88910c952c7469cee57cc5c5a8a07ad902 (diff)
fix(newos4): refuse shell composition, wc takes multiple paths (v4.6.58)
Packet 1 and 3 (silent wrong answers from a shell-less terminal). - detectComposition() in the security gate refuses ; && || | before dispatch. `;` used to fail loudly, but `&&`/`||` folded the right-hand side into the left command's argv (wc -l f && grep -c x f returned "42 42"), and a `|` arriving from the AI run_command tool bypassed splitPipe entirely and degraded the pattern to empty -- which matches every line. Operators inside quotes are untouched. - wc accepts multiple paths: one line per file plus a total, per-file errors for missing paths. `wc -c a b` used to print only `a` and exit 0. - help.html: "There is no shell" callout at the top of the command reference, plus the v4.6.57/58 changelog entry. Verified live on v4.6.58 by replaying the exact call sequence used by both paths: interactive `wc -c a b` -> "14 a / 10 b / 24 total"; `&&` and `;` refused; `echo "a && b"` still echoes; AI run_command semantics with `|` and `&&` refused; single command and multi-file wc still return real output.
Diffstat (limited to 'modules/core/module-system.js')
0 files changed, 0 insertions, 0 deletions