You'll notice
Useful4 Signal3
Adding an allow rule like Bash(git *) now warns the wildcard also auto-approves dangerous options.
What's wrong with this entry?
Anonymous. No account, no email.
What
Adding an allow rule such as Bash(git ) now warns that the wildcard also matches options placed at that position and approves them without prompting, and suggests putting the after the subcommand instead. git is called out because options like -c and --exec-path can run arbitrary commands.
Details
- This is a warning only. The rule is still accepted and saved.
- It fires during allow-rule validation, on the allow path only.
Evidence
For git, options such as -c and --exec-path can run arbitrary commands.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.