Introduce strict mode for shell injection#920

Draft

hansott wants to merge 2 commits into

mainfrom

strict-mode-shell-injection

GitHub Advanced Security / CodeQL succeeded Feb 6, 2026 in 2s

No new alerts in code changed by this pull request

View all branch alerts.

Annotations

Check warning on line 191 in library/sinks/ChildProcess.strict.test.ts

Code scanning / CodeQL

Unnecessary use of `cat` process Medium

Unnecessary use of cat process. Can be replaced with: fs.readFileSync("${IFS}/etc/passwd")