main resolves SQL clients behind env -S and its launcher grammars, but a
destructive statement still passed under four forms:
- a shell -c inside a short-option cluster (bash -lc, sh -ec), since only
an exact -c was looked up;
- su, whose -c / --command / -lc value runs through the target user's
shell, before or after --;
- taskset, whose mask or CPU list precedes the command, like timeout's
duration;
- a command nested past the shell -c recursion limit, which was allowed
instead of denied.
The first three are checked like sh -c; past the limit the check now
fails closed.
L4XB
f838085274