@wrongstack/tools 0.277.0 → 0.277.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/builtin.js +13 -0
- package/dist/builtin.js.map +1 -1
- package/dist/exec.js +13 -0
- package/dist/exec.js.map +1 -1
- package/dist/index.js +13 -0
- package/dist/index.js.map +1 -1
- package/dist/pack.js +13 -0
- package/dist/pack.js.map +1 -1
- package/package.json +2 -2
package/dist/index.js
CHANGED
|
@@ -3376,6 +3376,19 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
|
|
|
3376
3376
|
"nslookup",
|
|
3377
3377
|
"tracert",
|
|
3378
3378
|
"pathping",
|
|
3379
|
+
// Windows shell interpreters. Without these, `exec` cannot run cmd builtins
|
|
3380
|
+
// (`dir`, `type`, `copy`, …) or any PowerShell cmdlet on Windows — a major
|
|
3381
|
+
// gap since those are the platform's primary shells. Arbitrary execution
|
|
3382
|
+
// through `cmd /c …` / `powershell -c …` is NOT a new hole: the permission
|
|
3383
|
+
// policy reconstructs the full command line (shellCommandLineFromInput) and
|
|
3384
|
+
// still runs it through the YOLO destructive classifier, so a genuinely
|
|
3385
|
+
// destructive `cmd /c del /s /q C:\…` continues to require confirmation.
|
|
3386
|
+
"cmd",
|
|
3387
|
+
"cmd.exe",
|
|
3388
|
+
"powershell",
|
|
3389
|
+
"powershell.exe",
|
|
3390
|
+
"pwsh",
|
|
3391
|
+
"pwsh.exe",
|
|
3379
3392
|
// [core] Extended default allowlist (added 4b3d18d1 + this commit). All
|
|
3380
3393
|
// non-destructive, broadly-used dev binaries. Per-arg safety is still
|
|
3381
3394
|
// enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
|