- Resolve a wrapper-prefixed shell argv before scanning: subprocess.run(['env', 'bash', '-c',
'cat /etc/passwd']) hid the nested shell behind argv[0]=env, so only argv[0] was checked for a
shell binary and the -c payload was never scanned. Resolve the executed command word past
wrapper prefixes (via _blocked_in_argv) so env / timeout / nice wrapped bash -c is scanned.
- Skip a wrapper's numeric duration in the shell-string read scanner: timeout 1 bash -c
'cat /etc/passwd' treated the operand 1 as the command word, so the nested bash -c was not
reached. Add the same _is_wrapper_numeric_arg skip the blocklist path already uses.
- Honor args= when failing closed on a dynamic cwd: the fail-closed only inspected positional
argv, so subprocess.run(args=['cat', 'passwd'], cwd=P) slipped. Resolve the argv from the
public args= keyword too.
- Resolve a relative env -C against the ambient subprocess cwd: env -C . cat passwd under
cwd=/etc chdirs to /etc, not the bare fragment, so the relative reader still reads /etc/passwd.
Join a relative env -C / --chdir= operand onto the current child cwd instead of replacing it.
- Treat diff-style utilities as file readers: diff / sdiff / diff3 / colordiff / cmp print file
contents, so an escaping glob (diff /etc/pass* /dev/null) exfiltrated a secret. Add them to
the shell-read command allowlist.
- Expand a literal star-star dict unpack for the shell / cwd decisions: a shell= or cwd= smuggled
through subprocess.run(cmd, **{'shell': True}) was invisible to the kwarg loop (kw.arg is None).
Iterate keywords through a helper that also expands a literal dict unpack.
- Materialize a device-sink path via the base str.replace before trusting it: a str subclass
could override replace() to return '/dev/null' while its real value escaped the workdir. Call
the genuine str.replace on the underlying buffer so the real path is checked.
Adds TestRound29Bypasses plus a runtime device-sink str-subclass escape test.
e80c4b4b1f