What
Commands containing shell brace expansion patterns (e.g., {a,b} or {1..5}) are now detected and flagged, preventing potential command injection through expansion tricks.
Details
- Detects balanced brace pairs containing commas or range operators (
..) - Properly handles nested braces and escaped characters
- Blocks commands where brace expansion could alter command parsing
Evidence
New function ve9() performs brace detection; error message "Command contains brace expansion that could alter command parsing" (search for "brace expansion")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.