3 Commits

Author	SHA1	Message	Date
Marcus Widing	0f0b2c0255	fix(exec): match bare * wildcard in allowlist entries (#25082) ... The matchAllowlist() function skipped patterns without path separators (/, \, ~), causing a bare "*" wildcard entry to never reach the glob matcher. Since glob's single * maps to [^/]*, it would also fail against absolute paths. Handle bare "*" as a special case that matches any resolved executable path. Closes #25082	2026-02-24 14:20:11 +00:00
Peter Steinberger	a1c4bf07c6	fix(security): harden exec wrapper allowlist execution parity	2026-02-24 01:52:17 +00:00
Peter Steinberger	862975507a	refactor(exec): split command resolution and trusted-dir normalization	2026-02-22 23:00:33 +01:00