Problem
The PowerShell belt does not flag >> (append) redirection. A command that appends to a file
runs with no prompt, while the same command using > prompts.
plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py, on current main:
_POWERSHELL_OUTPUT_REDIRECT = re.compile(r"(?<![<>])>(?![=>&])")
The negative lookahead (?![=>&]) rejects a > followed by another >, so the first > of a
>> pair never matches. The second > is then rejected by the lookbehind (?<![<>]). Neither
character in the pair can match, so >> is invisible to the pattern.
Nothing else covers it. _POWERSHELL_MUTATION_WORDS catches the cmdlet spellings
(out-file, add-content, set-content) but not a bare shell append.
Reproduction
Get-ChildItem C:/tmp >> append.txt
No prompt. Compare:
Get-ChildItem C:/tmp > out.txt
Prompts, correctly.
Verified against the pattern as it stands on main:
| command |
flagged |
<cmd> > out.txt |
yes |
<cmd> 2>out.txt |
yes |
<cmd> 1>file |
yes |
<cmd> >> append.txt |
no |
Why it matters
Append is a file write. It creates the file when absent and grows it when present, so it is
squarely inside what the redirect check exists to catch — the guard's own message for the >
case is "shell output redirection (may overwrite a file)", and appending to a file the operator
did not intend to touch is the same class of accident.
The gap is also the more dangerous direction for this guard: a false negative is silent, whereas
the false positives tracked in #2615 and #2671 are at least visible as noise.
Suggested fix
Match the append form explicitly rather than widening the existing lookahead, which is load-bearing
for the stream-merge exclusion (2>&1) added in #2627 and the $null-discard exclusion in #2671.
Both of those exclusions must keep working; >> needs to be recognized without reopening either.
Care is needed on two adjacent forms so the fix does not over-correct:
Test coverage to add
In plugins/disk-hygiene/skills/clean/scripts/test_hygiene.py, alongside the existing
redirect tests: assert that >> append.txt, 2>>err.txt, and *>>all.txt produce a mutation
verdict, and that >> $null does not.
Provenance
Found while implementing #2671 (the $null-discard follow-up to #2615). It is pre-existing on
main, orthogonal to that change, and was deliberately left out of that PR rather than folded in.
Related
No linked issue: this report opens the issue rather than closing one.
Problem
The PowerShell belt does not flag
>>(append) redirection. A command that appends to a fileruns with no prompt, while the same command using
>prompts.plugins/disk-hygiene/skills/clean/scripts/destructive_guard.py, on currentmain:The negative lookahead
(?![=>&])rejects a>followed by another>, so the first>of a>>pair never matches. The second>is then rejected by the lookbehind(?<![<>]). Neithercharacter in the pair can match, so
>>is invisible to the pattern.Nothing else covers it.
_POWERSHELL_MUTATION_WORDScatches the cmdlet spellings(
out-file,add-content,set-content) but not a bare shell append.Reproduction
No prompt. Compare:
Prompts, correctly.
Verified against the pattern as it stands on
main:<cmd> > out.txt<cmd> 2>out.txt<cmd> 1>file<cmd> >> append.txtWhy it matters
Append is a file write. It creates the file when absent and grows it when present, so it is
squarely inside what the redirect check exists to catch — the guard's own message for the
>case is "shell output redirection (may overwrite a file)", and appending to a file the operator
did not intend to touch is the same class of accident.
The gap is also the more dangerous direction for this guard: a false negative is silent, whereas
the false positives tracked in #2615 and #2671 are at least visible as noise.
Suggested fix
Match the append form explicitly rather than widening the existing lookahead, which is load-bearing
for the stream-merge exclusion (
2>&1) added in #2627 and the$null-discard exclusion in #2671.Both of those exclusions must keep working;
>>needs to be recognized without reopening either.Care is needed on two adjacent forms so the fix does not over-correct:
*>>fileand2>>fileare stream-scoped appends and should flag.>> $nullis a discard, not a file write, and should stay silent — the same reasoning as fix(disk-hygiene): stop flagging PowerShell $null discards as file redirection #2671.Test coverage to add
In
plugins/disk-hygiene/skills/clean/scripts/test_hygiene.py, alongside the existingredirect tests: assert that
>> append.txt,2>>err.txt, and*>>all.txtproduce a mutationverdict, and that
>> $nulldoes not.Provenance
Found while implementing #2671 (the
$null-discard follow-up to #2615). It is pre-existing onmain, orthogonal to that change, and was deliberately left out of that PR rather than folded in.Related
$null-discard exclusion in the same pattern; its lookahead must survive this fix.No linked issue: this report opens the issue rather than closing one.