The shell guard's stream rule missed a shell handed the stdin device behind a pipe (/dev/stdin, /dev/fd/0) and a shell or source handed a process substitution as its script: each runs a downloaded stream as a script exactly as a pipe into a bare shell does, and each allowed. Found by review3-guard finding 4.

The shell guard's stream rule missed a shell handed the stdin device behind a pipe (/dev/stdin, /dev/fd/0) and a shell or source handed a process substitution as its script: each runs a downloaded stream as a script exactly as a pipe into a bare shell does, and each allowed. Found by review3-guard finding 4.

Grounds

• pursued: the stdin-device and process-substitution spellings block and a script file or file input does not (TestShellReadsStdinDeviceOrProcessSubstitution); an allowed stream spelling would show it wrong.