Catch a privileged heredoc redirected with >|

`>|` is a plain redirect with noclobber overridden, not a redirect followed by a pipe. command_destinations detached `>` from its target before looking at the bar, so the target read as `|` and the privileged path behind it was never examined: `cat <<EOF >| /etc/udev/rules.d/99-x.rules` with `$HOME` in the body produced no finding at all, while the same write through `>` produced one.

Normalizing `>|` to `>` alongside the existing `>>` handling closes it. The fixture fails without the normalization.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

This commit is contained in:

David Heinemeier Hansson

2026-08-30 08:58:12 +02:00

co-authored by

Claude Opus 5

parent 844f320bbe

commit 96404be37b

2 changed files with 10 additions and 0 deletions

									
										test/shell.d/fixtures/privileged-heredoc/route-noclobber-redirect.sh
									
		+4
		
												View File
												
				@@ -0,0 +1,4 @@

				# `>|` is a plain redirect with noclobber overridden, not a redirect into a pipe.

				cat >|/etc/omarchy/agent.conf <<EOF

				helper=$HOME/.local/share/omarchy/bin/omarchy-agent

				EOF