@wrongstack/tools 0.277.0 → 0.277.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/builtin.js +13 -0
- package/dist/builtin.js.map +1 -1
- package/dist/exec.js +13 -0
- package/dist/exec.js.map +1 -1
- package/dist/index.js +13 -0
- package/dist/index.js.map +1 -1
- package/dist/pack.js +13 -0
- package/dist/pack.js.map +1 -1
- package/package.json +2 -2
package/dist/exec.js
CHANGED
|
@@ -952,6 +952,19 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
|
|
|
952
952
|
"nslookup",
|
|
953
953
|
"tracert",
|
|
954
954
|
"pathping",
|
|
955
|
+
// Windows shell interpreters. Without these, `exec` cannot run cmd builtins
|
|
956
|
+
// (`dir`, `type`, `copy`, …) or any PowerShell cmdlet on Windows — a major
|
|
957
|
+
// gap since those are the platform's primary shells. Arbitrary execution
|
|
958
|
+
// through `cmd /c …` / `powershell -c …` is NOT a new hole: the permission
|
|
959
|
+
// policy reconstructs the full command line (shellCommandLineFromInput) and
|
|
960
|
+
// still runs it through the YOLO destructive classifier, so a genuinely
|
|
961
|
+
// destructive `cmd /c del /s /q C:\…` continues to require confirmation.
|
|
962
|
+
"cmd",
|
|
963
|
+
"cmd.exe",
|
|
964
|
+
"powershell",
|
|
965
|
+
"powershell.exe",
|
|
966
|
+
"pwsh",
|
|
967
|
+
"pwsh.exe",
|
|
955
968
|
// [core] Extended default allowlist (added 4b3d18d1 + this commit). All
|
|
956
969
|
// non-destructive, broadly-used dev binaries. Per-arg safety is still
|
|
957
970
|
// enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
|