A new static analyzer for sed commands has been added that validates redirect targets in sed pipelines. It checks for and flags:
- Commands that carry redirect-borne content that cannot be statically validated (swallowed arguments, unanalyzable heredocs, or expansion in a redirect target)
- Commands that are over-length or contain characters that bash and the analyzer tokenize differently
These now require explicit approval rather than being auto-allowed.
Evidence
sed analyzer (search for "sed command carries redirect-borne content" and "sed command could not be statically validated")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.