L4XB b8ce049abb fix(hooks): block a bypass that a brace group or subshell pipes into a shell ...

pipelineSources() read the literal output of the commands that feed a shell, but a brace group or subshell producer has no words of its own, so nothing it printed reached the check. { echo 'git commit --no-verify -m x'; } | sh and (echo 'git push --no-verify'; printf x) | bash passed the guard, while echo 'git commit --no-verify -m x' | sh is blocked. shell-scan now keeps the source text of a closed scope, and pipelineSources() reads the commands in it that write to the group's output, as it already does for a plain producer.

2026-10-23 07:19:32 +02:00

..

shell-scan.js

fix(hooks): block a bypass that a brace group or subshell pipes into a shell

2026-10-23 07:19:32 +02:00