What
Path and command analysis for the Bash tool on Windows is now run over several possible readings of the same string instead of one unquoted spelling, closing gaps where quoting could hide a path from a deny rule.
Details
- Deny-rule matching, redirection target collection, symlink and executable stem resolution, and dangerous-path detection all run across a variant set.
- Variants are the raw string plus three quote-stripping/unquoting passes covering curly quotes and backtick escapes, plus the text following a
::stream suffix. - Anything containing a quote character that still cannot be resolved statically now falls through to manual approval rather than being allowed silently.
- Windows only.
Evidence
Paths containing quote characters cannot be statically validated and require manual approval
Strings lifted out of the shipped bundle, so the claim above can be checked against them.