You'll notice
Useful3 Signal0
PowerShell commands touching sensitive paths are checked in every quoted form, so tricks can't slip past.
What's wrong with this entry?
Anonymous. No account, no email.
What
Sensitive-path and protected-path checks on PowerShell arguments now enumerate all candidate normalisations of a path rather than normalising once, and deny if any of them lands on a sensitive file.
Details
- Candidates are identity, quote-stripped and escape-stripped forms of the argument.
- When a path is not literally unquoted, the prompt no longer reports a
blockedPathand no longer offers add-directory or switch-to-acceptEdits suggestions, which could previously point at the wrong location. - A new safety-check reason covers the quote-stripping ambiguity and routes the call to manual approval.
Evidence
resolves near a sensitive file under quote-stripping and cannot be statically validated; requires manual approval
Strings lifted out of the shipped bundle, so the claim above can be checked against them.