claude-code - 💡(How to fix) Fix [FEATURE] Subcommand whitelisting [1 comments, 2 participants]

TL;DR

Allow whitelisting of the base command without requiring full command line whitelisting to improve usability and productivity.

Guidance

• Identify the base command that needs whitelisting, in this case, php -l, and determine how it can be isolated from varying command lines.
• Consider implementing a feature to whitelist commands based on a pattern or a subset of the command line, rather than the full command.
• Evaluate the current whitelisting mechanism to understand why it requires the full command line, and assess the feasibility of modifying it to support partial command matching.
• Develop a solution that can distinguish between the "real" command and shell constructs like loops, conditionals, and redirects to ensure security and flexibility.

Example

No specific code example can be provided without knowing the implementation details of the current whitelisting mechanism.

Notes

The proposed solution aims to balance security with usability, requiring careful consideration of potential security implications when allowing partial command whitelisting.

Recommendation

Apply a workaround by modifying the whitelisting mechanism to support pattern-based or partial command matching, as upgrading to a fixed version is not mentioned in the issue. This approach can help improve productivity while awaiting a more comprehensive solution.