fix: resolve system commands from trusted dirs to prevent PATH injection - #351

Merged

leongdl merged 9 commits into

OpenJobDescription:mainlinefrom

leongdl:fix/path-injection-rce

Aug 18, 2026

Commits on Aug 17, 2026

fix: use absolute paths for system commands to prevent PATH injection
leongdl
committed
231c951
fix: resolve system commands from trusted dirs, not PATH
leongdl
committed
d7b5b19
test: pin the trusted-path resolver's security properties
leongdl
committed
1839df4
fix: address automated review findings on the trusted-path resolver
leongdl
committed
68265a3
test: pin wrapper-before-symlink-farm ordering on NixOS
leongdl
committed
a144881
docs: Reframe resolver comments around problem and solution
leongdl
committed
98e15fe
fix: do not cache failed command lookups
leongdl
committed
3fcbe09

Commits on Aug 18, 2026