@wrongstack/tools 0.277.0 → 0.277.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/builtin.js +13 -0
- package/dist/builtin.js.map +1 -1
- package/dist/exec.js +13 -0
- package/dist/exec.js.map +1 -1
- package/dist/index.js +13 -0
- package/dist/index.js.map +1 -1
- package/dist/pack.js +13 -0
- package/dist/pack.js.map +1 -1
- package/package.json +2 -2
package/dist/pack.js
CHANGED
|
@@ -6210,6 +6210,19 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
|
|
|
6210
6210
|
"nslookup",
|
|
6211
6211
|
"tracert",
|
|
6212
6212
|
"pathping",
|
|
6213
|
+
// Windows shell interpreters. Without these, `exec` cannot run cmd builtins
|
|
6214
|
+
// (`dir`, `type`, `copy`, …) or any PowerShell cmdlet on Windows — a major
|
|
6215
|
+
// gap since those are the platform's primary shells. Arbitrary execution
|
|
6216
|
+
// through `cmd /c …` / `powershell -c …` is NOT a new hole: the permission
|
|
6217
|
+
// policy reconstructs the full command line (shellCommandLineFromInput) and
|
|
6218
|
+
// still runs it through the YOLO destructive classifier, so a genuinely
|
|
6219
|
+
// destructive `cmd /c del /s /q C:\…` continues to require confirmation.
|
|
6220
|
+
"cmd",
|
|
6221
|
+
"cmd.exe",
|
|
6222
|
+
"powershell",
|
|
6223
|
+
"powershell.exe",
|
|
6224
|
+
"pwsh",
|
|
6225
|
+
"pwsh.exe",
|
|
6213
6226
|
// [core] Extended default allowlist (added 4b3d18d1 + this commit). All
|
|
6214
6227
|
// non-destructive, broadly-used dev binaries. Per-arg safety is still
|
|
6215
6228
|
// enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
|