Aling33 48c884a533

fix(sandbox): treat a fetched process substitution as an interpreter program (#7290) ...

* fix(sandbox): treat a fetched process substitution as a program operand

`bash <(curl url)` hands the fetched file to bash as an *operand*, not as a
redirect: bash runs it. The audit only recognised the stdin spelling
(`bash < <(curl url)`), so the operand spelling executable-fetched content
through the sandbox audit unimpeded — the miss documented in the middlewares
AGENTS.md known-gaps list.

An interpreter in command position whose first operand is a risky process
substitution now blocks. The two exceptions mirror the stdin rule: a script
operand in front (`bash script.sh <(curl url)`) keeps the substitution an
ordinary argument, and a shell noexec flag (`bash -n <(curl url)`) only
parses it.

Verified in Git Bash:
  bash <(echo "echo FETCHED_AS_PROGRAM")            -> FETCHED_AS_PROGRAM
  bash <(echo "echo FETCHED_WITH_ARG") consumer.sh  -> FETCHED_WITH_ARG
  bash -n <(echo "echo NOEXEC")                     -> exit 0, no output

* docs(sandbox): clarify substitution audit limitations

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-10-23 21:08:17 +08:00

..

extension-api

feat(workflows): add durable restart recovery (Phase 3) (#7075)

2026-10-19 15:24:53 +08:00

harness

fix(sandbox): treat a fetched process substitution as an interpreter program (#7290)

2026-10-23 21:08:17 +08:00