feat(core): enhance shell command validation and add core tools allowlist (#25720)

Co-authored-by: David Pierce <davidapierce@google.com>
Co-authored-by: Keith Schaab <keithsc@google.com>
Co-authored-by: Keith Schaab <keith.schaab@gmail.com>
Co-authored-by: Emily Hedlund <ehedlund@google.com>
This commit is contained in:
Gal Zahavi
2026-04-23 13:26:01 -07:00
committed by GitHub
parent c024064f47
commit 27927c55e5
16 changed files with 632 additions and 88 deletions
+4 -2
View File
@@ -1993,13 +1993,15 @@ describe('getRipgrepPath', () => {
vi.mocked(fileExists).mockImplementation(
async (checkPath) =>
checkPath.includes(path.normalize('core/vendor/ripgrep')) &&
!checkPath.includes('tools'),
!checkPath.includes(path.join(path.sep, 'tools', path.sep)),
);
const resolvedPath = await getRipgrepPath();
expect(resolvedPath).not.toBeNull();
expect(resolvedPath).toContain(path.normalize('core/vendor/ripgrep'));
expect(resolvedPath).not.toContain('tools');
expect(resolvedPath).not.toContain(
path.join(path.sep, 'tools', path.sep),
);
});
it('should return null if binary is missing from both paths', async () => {