Three gaps from review:
- stripExecutionPrefixes skipped an unknown wrapper option without
knowing whether it consumed a value, so `chroot --userspec nobody:nogroup
/ psql -c "drop table users"` left `/` as the command and the SQL-client
check never ran. chroot's --userspec/--groups are modelled now, and an
unmodelled option marks the boundary as uncertain, in which case every
later token is tried as the command start.
- isDestructiveQuoteAware returned false past five nesting levels, so a
deep enough wrapper chain hid its payload from the scanner; it now
treats an uninspected payload as destructive.
- sqlArgumentText dropped only space-free filename-like tokens, so
`psql -f "drop table.sql"` was denied for its script name; -f/--file
values (separate and attached) are excluded before the SQL phrases are
matched.
Tests cover runuser --shell with a separate value, chroot with
--userspec and with an unmodelled option, the script-with-space
allow case, a script plus destructive -c, and the nesting limit.
L4XB
e2a69ff5df