From d21693df58b638c1b359288eff5bade1750e7605 Mon Sep 17 00:00:00 2001
From: Martin Vogel <martin.vogel.tech@gmail.com>
Date: Thu, 15 Oct 2026 03:18:42 +0200
Subject: [PATCH] fix(security): allow the bare wget token the shell pass
 compares

The v0.12.0 release smoke blocked every binary in its string audit:
"BLOCKED: Dangerous commands found in binary: wget". The line is the bare
string "wget" that src/pipeline/pass_shell.c compares a script's program
name with, and records as the `via` of a curl / wget HTTP_CALLS edge
(3b93db06). The binary never runs it.

Allow that whole line only, like the rst grammar's bare "telnet". A line
that carries a wget command (flags, a target, a URL) stays blocked; the
contract test now pins both cases.

Proof on the release run's own artifacts (run 38644765106, main 8df0639c):
linux-amd64-portable and darwin-arm64 binaries BLOCKED before, all three
audits OK after. test_security_strings_allowlist.sh: 49 passed; with the
allowlist line reverted, the new bare-token case fails.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
---
 scripts/security-strings.sh              | 1 +
 tests/test_security_strings_allowlist.sh | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/scripts/security-strings.sh b/scripts/security-strings.sh
index c7ff548435..9d6587e5b6 100755
--- a/scripts/security-strings.sh
+++ b/scripts/security-strings.sh
@@ -246,6 +246,7 @@ DANGEROUS_CMDS='wget|netcat|ncat|/dev/tcp|telnet'
 # evaluation. Document the source so reviewers can verify the false positive.
 ALLOWED_DANGEROUS=(
     '^telnet$'  # rst tree-sitter grammar: valid_schemas[] in vendored/grammars/rst/tree_sitter_rst/chars.c
+    '^wget$'    # src/pipeline/pass_shell.c: the program name a script's curl / wget HTTP_CALLS compares and records as `via`
 )
 if grep -wE "$DANGEROUS_CMDS" "$STRINGS_FILE" > "$SEC_CMDS" 2>/dev/null && [ -s "$SEC_CMDS" ]; then
     for allow in "${ALLOWED_DANGEROUS[@]}"; do
diff --git a/tests/test_security_strings_allowlist.sh b/tests/test_security_strings_allowlist.sh
index 921a10e638..0a6bdf90ff 100755
--- a/tests/test_security_strings_allowlist.sh
+++ b/tests/test_security_strings_allowlist.sh
@@ -170,6 +170,12 @@ done
 # content, not all tokenizer arrays or all boolean password assignments.
 make_fixture "$TMP/lookalike.bin" 'const keywords=["wget","telnet"];'
 assert_audit 1 "$COMMAND_BLOCKED" 'unreviewed command keyword array is blocked' "$TMP/lookalike.bin"
+# pass_shell.c compares a script's program name with the bare string "wget" (its
+# curl / wget HTTP_CALLS). Only that whole line is exempt; a command is not.
+make_fixture "$TMP/token.bin" 'wget'
+assert_audit 0 "$AUDIT_PASSED" 'bare wget token (pass_shell.c program name) is allowed' "$TMP/token.bin"
+make_fixture "$TMP/token.bin" 'wget -O /tmp/payload'
+assert_audit 1 "$COMMAND_BLOCKED" 'a wget command line remains blocked' "$TMP/token.bin"
 make_fixture "$TMP/lookalike.bin" 'this.password=!1;'
 assert_audit 1 "$CREDENTIAL_BLOCKED" 'unreviewed boolean password assignment is blocked' "$TMP/lookalike.bin"