mirror of
https://github.com/affaan-m/ECC.git
synced 2026-11-15 12:32:11 +00:00
L4XB
e2a69ff5df
Three gaps from review: - stripExecutionPrefixes skipped an unknown wrapper option without knowing whether it consumed a value, so `chroot --userspec nobody:nogroup / psql -c "drop table users"` left `/` as the command and the SQL-client check never ran. chroot's --userspec/--groups are modelled now, and an unmodelled option marks the boundary as uncertain, in which case every later token is tried as the command start. - isDestructiveQuoteAware returned false past five nesting levels, so a deep enough wrapper chain hid its payload from the scanner; it now treats an uninspected payload as destructive. - sqlArgumentText dropped only space-free filename-like tokens, so `psql -f "drop table.sql"` was denied for its script name; -f/--file values (separate and attached) are excluded before the SQL phrases are matched. Tests cover runuser --shell with a separate value, chroot with --userspec and with an unmodelled option, the script-with-space allow case, a script plus destructive -c, and the nesting limit.