mirror of
https://github.com/tailscale/tailscale.git
synced 2026-10-28 22:19:12 -04:00
The CastHeader recorded a shell-parsed reconstruction of the session command, but the command is passed to the user's shell verbatim, and the shell lexer silently drops unbalanced quotes. A spoofed command could therefore make the recording differ from what the shell actually ran. Record ss.RawCommand() instead. Updates tailscale/corp#50380 Signed-off-by: James Tucker <james@tailscale.com>