Not switched on
Useful3 Signal4
A guard that would reject commands found only in your current directory stays disabled.
Three spawn wrappers now share an unsafe-PATH check, but its controlling predicate returns false so nothing is refused.
What's wrong with this entry?
Anonymous. No account, no email.
What
A third spawn wrapper picked up the same guard as the other two: resolve the command and refuse it if it only resolves inside the current directory.
Details
- The predicate that controls all three call paths is a function that returns false in this build, so no command is refused at runtime.
- If enabled, a command found only in the current directory would be rejected as being in an unsafe location.
Evidence
not found or is in an unsafe location (current directory)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.236
macOS sandbox re-applies read and delete denials inside writable folders
Both mention sandbox
-
v2.1.236
Sandbox proxy no longer writes to sockets that have gone away
Both mention sandbox
-
v2.1.236
IPv6 hosts through the proxy
Both mention sandbox