Richard Feldman
576ff3ee03
This PR improves the shell command parser to correctly handle I/O redirects, here-documents, and compound command constructs. Previously, commands hidden inside redirect targets, here-document bodies, or function definition redirects could go undetected by the permission system. ## Changes - **Redirect handling**: Capture I/O redirects on simple commands, compound commands (`if`/`while`/`for`/`case`/subshells/brace groups), and function definitions - **Nested command extraction**: Extract commands from redirect file targets (e.g. `> $(dangerous_cmd)`) and here-document bodies - **Bare redirect rejection**: Return `None` for bare redirects with no command name (e.g. `> /etc/passwd`), which forces confirmation - **Compound command redirects**: Apply redirects on compound commands to their inner body commands - **Fail-closed error handling**: `extract_commands_from_word` and `normalize_word_piece_into` now return `None` on parse failures instead of silently succeeding - **Test coverage**: Extensive tests for quoted redirect targets, no-space redirects, clobber operators, fd-to-fd redirects, pipe+redirect combinations, function definition redirects, and more Release Notes: - Improved shell command parsing to correctly detect commands hidden in I/O redirects, here-documents, and compound command constructs.
Zed
Welcome to Zed, a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.
Installation
On macOS, Linux, and Windows you can download Zed directly or install Zed via your local package manager (macOS/Linux/Windows).
Other platforms are not yet available:
- Web (tracking issue)
Developing Zed
Contributing
See CONTRIBUTING.md for ways you can contribute to Zed.
Also... we're hiring! Check out our jobs page for open roles.
Licensing
License information for third party dependencies must be correctly provided for CI to pass.
We use cargo-about to automatically comply with open source licenses. If CI is failing, check the following:
- Is it showing a
no license specifiederror for a crate you've created? If so, addpublish = falseunder[package]in your crate's Cargo.toml. - Is the error
failed to satisfy license requirementsfor a dependency? If so, first determine what license the project has and whether this system is sufficient to comply with this license's requirements. If you're unsure, ask a lawyer. Once you've verified that this system is acceptable add the license's SPDX identifier to theacceptedarray inscript/licenses/zed-licenses.toml. - Is
cargo-aboutunable to find the license for a dependency? If so, add a clarification field at the end ofscript/licenses/zed-licenses.toml, as specified in the cargo-about book.
Sponsorship
Zed is developed by Zed Industries, Inc., a for-profit company.
If you’d like to financially support the project, you can do so via GitHub Sponsors. Sponsorships go directly to Zed Industries and are used as general company revenue. There are no perks or entitlements associated with sponsorship.