Charlie Marsh f97e775693
Fail closed on deeply nested command wrappers ( #39122 ) ...
## Why
Dangerous-command inspection has a bounded wrapper depth. Returning no match
after that limit could let a nested dangerous payload escape policy detection.
## What changed
- Classify commands beyond the wrapper-depth limit as dangerous.
- Cover the boundary and overflow cases in the command-safety unit tests.
- Verify that exec policy rejects a deeply `env`-wrapped forced `rm` before it
can delete a sentinel file when approvals are disabled.
GitOrigin-RevId: a6cdbbb7bdc6274a62745f668189fabaaf46745f
2026-08-18 02:23:57 +00:00
2026-07-29 13:53:15 +00:00
2026-06-09 12:48:04 -07:00
2026-07-23 19:19:35 +00:00
2026-07-21 22:44:43 +00:00
2026-08-17 04:01:37 +00:00
2026-07-29 13:53:15 +00:00
2026-08-18 00:45:00 +00:00
2026-08-18 00:45:00 +00:00
2026-07-21 08:50:21 +00:00
2026-08-17 21:49:30 +00:00
2026-07-30 19:47:30 +00:00
2026-08-17 04:01:37 +00:00
2026-08-16 06:48:59 +00:00
2026-08-10 18:44:58 +00:00
2026-08-10 01:39:55 +00:00
2026-06-11 18:16:39 -07:00
2026-08-17 13:20:58 +00:00
2026-08-11 03:39:02 +00:00
2026-08-14 05:03:39 +00:00
2026-08-17 22:37:14 +00:00
2026-08-18 00:31:51 +00:00
2026-08-13 19:35:22 +00:00
2026-08-13 19:35:22 +00:00
2026-07-21 08:28:51 +00:00
2026-06-11 18:16:39 -07:00
2026-08-14 20:42:35 +00:00
2026-08-15 21:26:28 +00:00
2026-08-14 22:40:19 +00:00
2026-08-05 16:09:01 +00:00
2026-08-15 01:34:33 +00:00
2026-07-30 21:49:53 +00:00
2026-08-13 23:13:37 +00:00
2026-06-15 20:10:53 -07:00
2026-08-17 19:38:18 +00:00
2026-08-04 22:58:02 +00:00
2026-08-18 00:45:00 +00:00
2026-08-07 00:23:38 +00:00
2026-08-03 11:39:51 +00:00
2026-08-18 02:23:57 +00:00
2026-08-17 19:22:45 +00:00
2026-08-17 22:26:27 +00:00
2026-08-07 11:30:17 +00:00
2026-08-13 00:00:16 +00:00
2026-08-17 21:49:30 +00:00
2026-08-17 22:53:55 +00:00
2026-08-17 21:49:30 +00:00
2026-08-17 04:37:50 +00:00
2026-08-17 22:26:27 +00:00
2026-08-17 22:26:27 +00:00
2026-08-17 18:41:50 +00:00
2026-08-07 19:56:29 +00:00
2026-07-31 21:37:56 +00:00
2026-08-17 21:49:30 +00:00
2026-05-28 23:09:55 -07:00
2026-08-10 15:50:53 +00:00
2026-08-14 12:16:51 +00:00
2026-08-17 04:17:45 +00:00
2026-08-17 00:09:44 +00:00
2026-08-10 22:12:14 +00:00
2026-06-12 19:52:49 +00:00
2026-08-17 23:21:28 +00:00
2026-07-22 04:17:34 +00:00
2026-08-17 22:26:27 +00:00
2026-08-17 10:01:59 +00:00
2026-08-14 13:44:51 +00:00
2026-07-17 20:52:42 +00:00
2026-08-17 23:08:26 +00:00
2026-08-14 01:23:59 +00:00
2026-08-17 23:08:26 +00:00
2026-08-17 19:22:45 +00:00
2026-07-30 04:26:36 +00:00
2026-08-17 19:06:53 +00:00
2026-08-10 14:25:13 +00:00
2026-08-17 21:49:30 +00:00
2026-08-17 21:49:30 +00:00
2026-08-15 01:34:33 +00:00
2026-08-17 23:04:09 +00:00
2026-08-17 04:01:37 +00:00
2026-08-06 03:11:42 +00:00
2026-08-17 21:49:30 +00:00
2026-05-26 20:59:47 -07:00
2026-08-10 15:43:10 +00:00
2026-08-18 02:23:57 +00:00
2026-08-08 16:58:26 +00:00
2026-08-17 20:19:04 +00:00
2026-08-17 17:19:46 +00:00
2026-08-04 03:49:53 +00:00
2026-08-18 00:45:00 +00:00
2026-08-17 17:19:46 +00:00
2026-08-14 05:49:33 +00:00
2026-08-18 01:00:48 +00:00
2026-08-17 21:49:30 +00:00
2026-07-22 16:18:08 +00:00
2026-06-13 21:43:39 -07:00
2026-07-24 00:16:42 +00:00
2026-08-17 21:49:30 +00:00
2026-08-15 14:31:04 +00:00
2026-07-09 17:31:44 -07:00
2026-08-17 23:04:09 +00:00
2026-08-17 23:04:09 +00:00
2026-07-28 20:49:22 +00:00
2026-07-11 03:27:51 +00:00
2026-07-29 13:53:15 +00:00
2026-08-11 23:40:07 +00:00
2026-06-04 09:16:03 -07:00
2026-05-26 20:59:47 -07:00
Charlie Marsh
f97e775693