{"record":{"id":"9d312530cd0bc18f","repo":"ruvnet/ruflo","slug":"command-chaining","errorCode":"COMMAND_CHAINING","errorMessage":"Potential command chaining in argument: ${arg}","messagePattern":"Potential command chaining in argument: (.+?)","errorType":"exception","errorClass":"SafeExecutorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/safe-executor.ts","lineNumber":282,"sourceCode":"          args\n        );\n      }\n\n      // Check against blocked patterns\n      for (const pattern of this.blockedPatterns) {\n        if (pattern.test(arg)) {\n          throw new SafeExecutorError(\n            `Dangerous pattern detected in argument: ${arg}`,\n            'DANGEROUS_PATTERN',\n            undefined,\n            args\n          );\n        }\n      }\n\n      // Check for command chaining attempts\n      if (/^-.*[;&|]/.test(arg)) {\n        throw new SafeExecutorError(\n          `Potential command chaining in argument: ${arg}`,\n          'COMMAND_CHAINING',\n          undefined,\n          args\n        );\n      }\n    }\n  }\n\n  /**\n   * Sanitizes a single argument.\n   *\n   * @param arg - Argument to sanitize\n   * @returns Sanitized argument\n   */\n  sanitizeArgument(arg: string): string {\n    // Remove null bytes\n    let sanitized = arg.replace(/\\0/g, '');","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/safe-executor.ts#L264-L300","documentation":"SafeExecutor.validateArguments detected an argument beginning with '-' that also contains ';', '&', or '|' — the signature of trying to combine an option flag with command chaining to smuggle a second command past the shell-less exec. The execution is refused rather than attempting to sanitize.","triggerScenarios":"Thrown at v3/@claude-flow/security/src/safe-executor.ts:282 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Split chained commands into separate executor calls.","Reject arguments containing ; && || | and execute each step independently with validated commands."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}