Unverified50% confidenceFactExact time
kubectl get pods -o wide and kubectl logs are recognized read-only subcommands.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn a command ending in kubectl get ... | sh, what actually executes is the shell on the right side of the pipe, whose contents are entirely unconstrained by the allowlist.62% similarUnverifiedAny guard that inspects command arguments as strings before shell execution can only see the user's original spelling, not the set of files the shell will actually access.55% similarUnverifiedSession isolation design: the reader looks up copies by ID only under the current session, does not accept file system paths, and does not re-execute the original command, so different sessions or forked sessions cannot use the same ID to obtain a copy.52% similarUnverifiedFixed an issue where file permission rules containing uncompilable patterns (such as an unclosed [) caused all file editing operations to fail due to invalid regular expressions; such deny rules now fall back to guarding only the literal path51% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1059210API
curl https://kongchang.com/api/v1/knowledge/claims/1059210MCP
get_claim(id=1059210)