What
New security checks detect and flag potentially obfuscated bash commands that could bypass permission checks.
Details
- Detects commands containing quoted newlines followed by
#-prefixed lines, which can hide arguments from line-based permission scanning - Detects consecutive quote characters at word start (potential obfuscation)
- Detects empty quote pairs adjacent to quoted dashes (flag obfuscation)
- Sanitizes redirects to Windows
NULdevice by replacing with/dev/null - Flagged commands trigger an "ask" behavior requiring explicit user approval
Evidence
Security checks (search for "potential obfuscation", "quoted newline", "$1/dev/null")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.