What: Expanded detection of Universal Naming Convention (UNC) paths that could access network shares and remote resources.
Details:
- Comprehensive pattern detection - Now detects 6 different UNC path patterns (previously only 1):
- Traditional backslash notation:
\\server\share - Forward-slash notation:
//server/share - WebDAV paths containing
DavWWWRoot - IPv4-based paths:
\\192.168.1.1\share - IPv6-based paths:
\\[2001:db8::1]\share - SSL/port notation variations:
@SSL@443,@443@SSL - Defense-in-depth check - Added explicit UNC path verification in permission checking that triggers before other path validation, requiring manual user approval with message: "Claude requested permissions to read from {path}, which appears to be a UNC path that could access network resources"
- Evidence:
kB1() at line 469623,Cm() at line 474419(new UNC check at lines 474427-474436)