(command: string)
| 607 | * unavailable. The primary gate is parseForSecurity (ast.ts). |
| 608 | */ |
| 609 | export function isUnsafeCompoundCommand_DEPRECATED(command: string): boolean { |
| 610 | // Defense-in-depth: if shell-quote can't parse the command at all, |
| 611 | // treat it as unsafe so it always prompts the user. Even though bash |
| 612 | // would likely also reject malformed syntax, we don't want to rely |
| 613 | // on that assumption for security. |
| 614 | const { processedCommand } = extractHeredocs(command) |
| 615 | const parseResult = tryParseShellCommand( |
| 616 | processedCommand, |
| 617 | varName => `$${varName}`, |
| 618 | ) |
| 619 | if (!parseResult.success) { |
| 620 | return true |
| 621 | } |
| 622 | |
| 623 | return splitCommand_DEPRECATED(command).length > 1 && !isCommandList(command) |
| 624 | } |
| 625 | |
| 626 | /** |
| 627 | * Extracts output redirections from a command if present. |
no test coverage detected