#3107 resolves sudo, doas and env before matching a SQL client, and
recurses into sh -c. Six shapes still reached a client unseen and were
allowed:
bash -lc "psql -c 'drop table users'" a -c inside a flag cluster
env -S 'psql -c "drop table users"' the command inside one argument
env --split-string='...' (same)
env time -f "%E" psql -c "..." time, nice, timeout, nohup,
nice -n 10 psql -c "..." stdbuf, ionice, setsid,
timeout 30 psql -c "..." command, exec as runners
Unwrap those runners with their options and positionals, stacked without
a fixed limit, scan env -S payloads as command lines, and accept a -c
inside a short-option cluster. Past the shell recursion limit the check
now fails closed: five levels of sh -c used to hide a drop table.
L4XB
f35470e9b8