{"version":"2.1.221","anchor":"powershell-path-permission-checks-consider-every-de-quoting-","canonical_anchor":"powershell-path-permission-checks-consider-every-de-quoting-","heading":"PowerShell path permission checks consider every de-quoting of a path","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/powershell-path-permission-checks-consider-every-de-quoting-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### PowerShell path permission checks consider every de-quoting of a path\n\nPowerShell commands touching sensitive paths are checked in every quoted form, so tricks can't slip past.\n\n**What**\n\nSensitive-path and protected-path checks on PowerShell arguments now enumerate all candidate normalisations of a path rather than normalising once, and deny if any of them lands on a sensitive file.\n\n**Details**\n\n- Candidates are identity, quote-stripped and escape-stripped forms of the argument.\n- When a path is not literally unquoted, the prompt no longer reports a `blockedPath` and no longer offers add-directory or switch-to-acceptEdits suggestions, which could previously point at the wrong location.\n- A new safety-check reason covers the quote-stripping ambiguity and routes the call to manual approval.\n\n**Evidence**\n\n`resolves near a sensitive file under quote-stripping and cannot be statically validated; requires manual approval`\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}