mirror of
https://github.com/Gitlawb/openclaude.git
synced 2026-08-28 18:24:55 -05:00
ebc9c70bb5
* fix(bashSecurity): reject nested heredoc ranges in stripSafeHeredocSubstitutions isSafeHeredoc already rejects nested $(cat <<'A'...A) matches to prevent stale-index corruption when stripping in reverse order. Apply the same guard to stripSafeHeredocSubstitutions, which was missing it. Without the check, a nested inner range stripped first leaves outer.end stale. result.slice(outer.end) then skips any trailing content (e.g., `; rm -rf /`), silently hiding it from downstream validators. Fix: return null on nested ranges so callers fall back to full command validation. * test(bashSecurity): add regression tests for stripSafeHeredocSubstitutions Covers: single heredoc strip, nested heredoc null-return (stale-index regression), no heredoc present, and multiple non-nested heredocs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>