Close six static-classifier bypasses in studio/backend/core/inference/tools.py:
- Unsafe PATH search list: a PATH prefix or env mapping with a relative / cwd
entry (PATH=. cmd, PATH=.:$PATH, env={'PATH': '.'}) lets a bare command word
resolve to a workdir shebang, defeating the bare-name PATH exemption. New
_path_value_is_unsafe flags such assignments in the shell-prefix, standalone,
and subprocess env= forms.
- git shell-dispatch alias: git -c alias.X=!CMD X and git config alias.X !CMD run
CMD through an unguarded shell while the scanner sees only git. Detect the !
marker on an alias config value in both the shell-string path and the argv path
(git added to the argv-tail rescan set).
- executable= override: subprocess(argv, executable=PROG) runs PROG with argv[1:]
as its flags, so scanning argv and executable separately misses
run(['x','-i','s/a/b/','/f'], executable='/usr/bin/sed'). Reconstruct PROG +
argv tail and scan the effective command line.
- alias body: alias x='touch f'; x runs the alias body at execution time under a
command word the scanner cannot resolve; scan the body of each alias definition.
- trap -- terminator: trap -- 'CMD' EXIT left the handler unscanned because the
handler operand was read as the -- token. Skip trap options / -- in both the
blocked-command and sensitive-read trap scans.
- interactive / persisted-startup shells: bash -i (and combined -ic) sources rc
files before the -c payload, and an exported BASH_ENV / ENV in a separate
command persists for later shells; flag both as unscanned startup.
Regression coverage: TestRound34Bypasses in tests/test_sandbox_tools.py.
c2e10298b0