You'll notice
Useful3 Signal3
Commands literally named constructor or __proto__ no longer skew Bash permission checks.
What's wrong with this entry?
Anonymous. No account, no email.
What
Bash and PowerShell permission checking looked commands up in its tables by direct property access, so a command literally named constructor or __proto__ matched a built-in language property instead of missing. Lookups now go through a safe helper, so such names can no longer skew write detection or argument skipping.
Details
- The affected tables are the ones listing command wrappers, options and verbs used to work out whether a command writes and which arguments to ignore.
- A write with no determinable target still falls back to asking you:
is a write operation but no target path could be determined; requires manual approval.
Evidence
is a write operation but no target path could be determined; requires manual approval
Strings lifted out of the shipped bundle, so the claim above can be checked against them.