[p-linnane]

brew.sh rejects command names containing /, . or .. but brew help <name> reaches Commands.path without that check, and which builds its candidates with File.expand_path, so brew help ../../x could resolve and run an executable outside the command directories. Before this change printf '#!/bin/sh\necho ran\n' > /tmp/x/brew-poc && chmod +x /tmp/x/brew-poc && brew help ../../../../../../../tmp/x/brew-poc prints ran.

The same check now guards the external command lookups so every caller of Commands.path rejects such names, and internal_cmd_name? becomes valid_cmd_name? since it no longer applies only to internal commands.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude Code (Mythos 5.1) found the gap while triaging a report, wrote the change and test, checked that the new example fails without the change, ran brew lgtm and checked brew help and brew against internal, external and path-like command names before and after the change.

---

[coderabbitai]

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Bug Fixes
  • Invalid command names containing path separators or consisting of . or .. are no longer searched for executable paths, including for external commands. This prevents such names from resolving to unintended locations.

The command-name validator is now named Commands.valid_cmd_name?. Internal and external command path lookups reject invalid names before searching. A test checks that a traversal-style command name does not resolve to an executable internal command.

Changes: Command path validation

Layer / File(s)	Summary
Validate command names before path lookup Library/Homebrew/commands.rb, Library/Homebrew/test/commands_spec.rb, Library/Homebrew/brew.sh	Renames the validator and applies it to internal and external command path lookups. Adds a test for a traversal-style command name and updates the related comment.

Merge Risk: Minimal · up to 652c9

The command-name validation change is ready to merge with no identified blocking risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "Apply the command name check to external lookups" matches the main change. The PR applies the existing command-name validation to external command lookups in Commands.path, which the raw su…
Description check		The description explains the problem: brew help reaches Commands.path without the name check in brew.sh, which allows path-like names to resolve outside command directories. It states the fix (…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "Apply the command name check to external lookups" matches the main change. The PR applies the existing command-name validation to external command lookups in Commands.path, which the raw summary and PR objectives both describe. It is specific and does not use vague terms.

Full details: Description check

Explanation

The description explains the problem: brew help <name> reaches Commands.path without the name check in brew.sh, which allows path-like names to resolve outside command directories. It states the fix (applying the same check to external lookups), the rename of internal_cmd_name? to valid_cmd_name?, a reproduction example, and testing performed. This relates directly to the changeset.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 88664e92-c557-4611-a5cd-4d3a6bea16e9

Commits

Reviewing files that changed from the base of the PR and between 96d2a24 and 652c9c6.

Files selected for processing: 3

• Library/Homebrew/brew.sh
• Library/Homebrew/commands.rb
• Library/Homebrew/test/commands_spec.rb

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[MikeMcQuaid]

Thanks!