{"version":"2.0.33","anchor":"enhanced-security-path-resolution-bypass-protection-2","canonical_anchor":"enhanced-security-path-resolution-bypass-protection-2","heading":"Enhanced Security: Path Resolution Bypass Protection","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.0.33\/e\/enhanced-security-path-resolution-bypass-protection-2","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.0.33","markdown":"### Enhanced Security: Path Resolution Bypass Protection\n\n**What:** Three new security checks to prevent attacks using shell expansion and directory changes\n\n**Examples that now require approval:**\n\n`echo \"data\" > \/tmp\/$VAR\/file.txt # Variable expansion in redirect cd \/tmp && rm -rf important\/ # Directory change with write operation cat file > \/etc\/$(whoami)\/config # Command substitution in path` **Details:**\n\n- Shell expansion detection: Regex `\/(?:>>?)\\s*\\S*\\$\/` catches variable expansion with redirections\n- Dollar sign in paths: Any file path containing `$` character requires approval\n- CD with write operations: Compound commands using `cd` + write operations require approval\n- All checks use `\"ask\"` behavior (require approval) rather than `\"deny\"`\n- **Evidence**: `tP1()` at line 254131, `TYQ()` at line 253932, `Fe8()` at line 253997"}