On Windows, previously approved commands that wrap a shell, run long or use many redirects get asked again.
What's wrong with this entry?
Also on Windows only, a previously-approved command is bumped back to an approval prompt when its first word is a shell such as bash, sh, zsh, dash, ksh, mksh or busybox, because the security scan cannot see into the code that shell will run from a string. Over-long commands and commands packed with redirects are re-asked for the same reason.
- Message shown:
This previously-approved command runs shell code from a string its security scan cannot see into; on Windows its writes cannot be checked for Cygwin symlink redirection and need human review. - New pattern matching pulls redirect targets (
<,>,>>,&>,>|,>&) straight out of raw command text when the command could not be parsed into a syntax tree. - Existing interpreter sets still apply; the shell list above is new.
- The
cd-compound case gets its own separate explanation.
This previously-approved command runs shell code from a string its security scan cannot see into; on Windows its writes cannot be checked for Cygwin symlink redirection and need human review.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
Windows policy helpers can be PowerShell scripts
Both mention window
-
v2.1.234
Windows sandbox refusals now say why an exclusion did not apply
Both mention window
-
v2.1.234
Terminal is restored on Ctrl+Break on Windows
Both mention window