Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

fix(guardrails): block-root-delete-target skips a PowerShell target holding a literal dollar sign

Open
  • Is something wrong?
#6,626 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
powershell, shell
Domain
cli, security

Research direction

Start by tracing the block-root-delete-target hook and its rdt_place_to operand handling for PowerShell single-quoted words; inspect the related work in #6020 and #6542. Reproduce the reported cases, including the cmd /c rd invocation from Bash, and determine whether that lane is wired or a declared gap. Done means literal $ operands and ::$ stream suffixes are judged safely, and the cmd case is judged or documented as a gap.

Written by the indexing model from the issue text.

Description

needs-human needs-triage

Problem

block-root-delete-target leaves a PowerShell target alone when it holds a $, even inside single quotes, where PowerShell expands nothing. rdt_place_to returns "leave alone" for any $ in an operand that is not literal, and a PowerShell single-quoted word goes down that path.

On Win32, <dir>::$INDEX_ALLOCATION names the directory itself, so a spelling like the one below may reach a directory the guard would otherwise refuse.

Repro (hook side confirmed; PowerShell runtime side not verified)

With the key unset and cwd /:

  • Remove-Item -Recurse -Force 'D:\some\outside\dir' exits 2 (refused).
  • Remove-Item -Recurse -Force 'D:\some\outside\dir::$INDEX_ALLOCATION' exits 0 (allowed).

Also seen in the same review: cmd /c rd /s /q <dir> issued from the Bash tool exits 0 even for a directory outside the allowed roots. Check whether this is a declared gap or a lane that is simply not wired.

Acceptance

  • A single-quoted PowerShell operand is judged literally: a $ in it does not skip judgment.
  • A ::$INDEX_ALLOCATION (or other ::$ stream) suffix is judged as the directory before it, or refused.
  • The cmd /c rd from Bash case is either judged or listed as a declared gap.

Related: #6020. Found by the security review of #6542.

Dominant language
Shell
Stars
22
Forks
2
Avg merge
5h 18m
Merged PRs (30d)
869

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from melodic-software/claude-code-plugins

All issues in melodic-software/claude-code-plugins

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.