{"record":{"id":"a6d751d9b6ba2bfa","repo":"ruvnet/ruflo","slug":"dangerous-command-allowed","errorCode":"DANGEROUS_COMMAND_ALLOWED","errorMessage":"Dangerous commands cannot be allowed: ${dangerousAllowed.join(', ')}","messagePattern":"Dangerous commands cannot be allowed: (.+?)","errorType":"exception","errorClass":"SafeExecutorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/safe-executor.ts","lineNumber":210,"sourceCode":"\n  /**\n   * Validates executor configuration.\n   */\n  private validateConfig(): void {\n    if (this.config.allowedCommands.length === 0) {\n      throw new SafeExecutorError(\n        'At least one allowed command must be specified',\n        'EMPTY_ALLOWLIST'\n      );\n    }\n\n    // Check for dangerous commands in allowlist\n    const dangerousAllowed = this.config.allowedCommands.filter(\n      cmd => DANGEROUS_COMMANDS.includes(path.basename(cmd))\n    );\n\n    if (dangerousAllowed.length > 0) {\n      throw new SafeExecutorError(\n        `Dangerous commands cannot be allowed: ${dangerousAllowed.join(', ')}`,\n        'DANGEROUS_COMMAND_ALLOWED'\n      );\n    }\n  }\n\n  /**\n   * Validates a command against the allowlist.\n   *\n   * @param command - Command to validate\n   * @throws SafeExecutorError if command is not allowed\n   */\n  private validateCommand(command: string): void {\n    const basename = path.basename(command);\n\n    // Check if command is allowed\n    const isAllowed = this.config.allowedCommands.some(allowed => {\n      const allowedBasename = path.basename(allowed);","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/safe-executor.ts#L192-L228","documentation":"SafeExecutor config validation: one or more entries in allowedCommands have a basename present in DANGEROUS_COMMANDS (e.g. rm, sh). The allowlist is meant to be a safe subset of executables; allowing inherently dangerous commands would defeat the executor's purpose, so construction is refused and the offending names listed.","triggerScenarios":"Thrown at v3/@claude-flow/security/src/safe-executor.ts:210 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the listed dangerous commands from the allowlist.","If a dangerous command is genuinely required, use a dedicated audited wrapper instead of the generic executor."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}