Development record
A script downloaded to a file and run on the same line (curl to a file, then bash, sh < or source of that file) is not caught: the same-line file carry built for pid lists on branch fix/sec-g2-261011 is not consulted by interpreter-reads-stream. Pre-existing (the base allows it too); found by the Fable review of guard rounds G2.
issueresolvedminoriss-2610120916248850
A script downloaded to a file and run on the same line (curl to a file, then bash, sh < or source of that file) is not caught: the same-line file carry built for pid lists on branch fix/sec-g2-261011 is not consulted by interpreter-reads-stream. Pre-existing (the base allows it too); found by the Fable review of guard rounds G2.
Frontmatter
| id | iss-2610120916248850 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610120916248850-guard-downloaded-script-file-run-same.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2610120953449511A source or . of a file the same line writes is allowed unread when the file does not exist at check time: printf '<blocker>' > n.sh; source n.sh allows, because the source search finds no file and the written-then-run check is only made for a file it found, while bash n.sh on the same line blocks as script-written-then-run. Found in security lane G3, 2026-10-12, while fixing iss-2610120916248850 (the downloaded-file form of the same gap is now refused as a stream).