{"version":"2.0.33","anchor":"enhanced-security-path-resolution-bypass-protection","canonical_anchor":"enhanced-security-path-resolution-bypass-protection","heading":"Enhanced Security: Path Resolution Bypass Protection","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.0.33\/e\/enhanced-security-path-resolution-bypass-protection","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.0.33","markdown":"### Enhanced Security: Path Resolution Bypass Protection\n\n**What:** Three new security checks to prevent attacks using shell expansion and directory changes **How to use:** These protections are automatic. Commands that trigger them will prompt for approval:\n\n`# These patterns now require manual approval: echo \"data\" > \/tmp\/$VAR\/file.txt # Variable expansion in redirect cd \/tmp && rm -rf important\/ # Directory change with write operation cat file > \/etc\/$(whoami)\/config # Command substitution in path` **Details:**\n\n- **Shell expansion detection**: Regex `\/(?:>>?)\\s*\\S*\\$\/` catches variable expansion with redirections\n- **Dollar sign in paths**: Any file path containing `$` character now requires approval to prevent variable expansion bypass\n- **CD with write operations**: Compound commands using `cd` followed by write operations (rm, mv, cp, etc.) require approval since final working directory cannot be statically verified\n- All three checks use `\"ask\"` behavior (require approval) rather than `\"deny\"` to allow legitimate use cases\n- **Evidence**: Shell expansion check in `tP1()` at line 254131, dollar sign check in `TYQ()` at line 253932, cd detection in `Fe8()` at line 253997"}