Repository navigation

fix: resolve system commands from trusted dirs to prevent PATH injection - #351

Merged

leongdl merged 9 commits into

OpenJobDescription:mainlinefrom

leongdl:fix/path-injection-rce

Aug 18, 2026

Merged

fix: resolve system commands from trusted dirs to prevent PATH injection#351
leongdl merged 9 commits into
OpenJobDescription:mainlinefrom
leongdl:fix/path-injection-rce

Commits on Aug 17, 2026
- fix: use absolute paths for system commands to prevent PATH injection
  leongdl
  committed
  231c951
- fix: resolve system commands from trusted dirs, not PATH
  leongdl
  committed
  d7b5b19
- test: pin the trusted-path resolver's security properties
  leongdl
  committed
  1839df4
- fix: address automated review findings on the trusted-path resolver
  leongdl
  committed
  68265a3
- test: pin wrapper-before-symlink-farm ordering on NixOS
  leongdl
  committed
  a144881
- docs: Reframe resolver comments around problem and solution
  leongdl
  committed
  98e15fe
- fix: do not cache failed command lookups
  leongdl
  committed
  3fcbe09
Commits on Aug 18, 2026
- test: Wrap a RANGE_EXPR parameter in string() before repr_sh
  leongdl
  committed
  fe9c014
- test: Use posixpath.isabs for the POSIX trusted-directory entries
  leongdl
  committed
  76faa23