[BUG] Bash tool bypasses settings.json path deny rules — shell commands not subject to file tool access controls #39987

Activity

1. yth0-n0

   added

   bugSomething isn't workingSomething isn't working

   on Mar 27, 2026
2. github-actions

   added

   area:permissions

   area:bash

   area:security

   platform:windowsIssue specifically occurs on WindowsIssue specifically occurs on Windows

   platform:vscodeIssue specifically occurs in VS CodeIssue specifically occurs in VS Code

   on Mar 27, 2026
3. yurukusa commented on Mar 28, 2026

   

   yurukusa

   on Mar 28, 2026

   More actions

   Until the Bash tool respects path deny rules natively, a PreToolUse hook can enforce the same restrictions on shell commands:

   INPUT=$(cat)
   COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
   [ -z "$COMMAND" ] && exit 0
   DENIED="${CC_DENIED_PATHS:-}"
   [ -z "$DENIED" ] && [ -f "$HOME/.claude/denied-paths.txt" ] && \
       DENIED=$(grep -v '^#' "$HOME/.claude/denied-paths.txt" | tr '\n' ':')
   [ -z "$DENIED" ] && exit 0
   IFS=':'
   for path in $DENIED; do
       [ -z "$path" ] && continue
       if echo "$COMMAND" | grep -qF "${path%/}"; then
           echo "BLOCKED: Bash command accesses denied path: ${path%/}" >&2
           exit 2
       fi
   done
   exit 0

   Setup:

   echo "/path/to/deny" >> ~/.claude/denied-paths.txt

   This applies your deny rules to cat, grep, head, and any other Bash command that references the denied path. Exit code 2 blocks at the process level.
   Install: npx cc-safe-setup --install-example path-deny-bash-guard

   👍React with 👍1Reacted by yth0-n0
4. El-Fitz commented on Apr 1, 2026

   

   El-Fitz

   on Apr 1, 2026

   More actions

   Until the Bash tool respects path deny rules natively, a PreToolUse hook can enforce the same restrictions on shell commands

   Came to say exactly this ^^

   If you’re interested in other patterns my agent has compiled a few into bash-guard (https://github.com/Bande-a-Bonnot/Boucle-framework/tree/main/tools/bash-guard).

   One caveat: string-based path matching in shell commands is inherently approximate. cat /denied/file is straightforward, but cd /tmp && cat ../denied/file resolves differently at runtime.

   Hook-level enforcement catches direct references but cannot guarantee coverage against all indirect ones. For true isolation, pair the hook with OS-level file permissions that deny the user account access to the protected directory.

   Overall, best solution for now would probably be to get a distinct Claude Code session to work on it and come up with something suited for your specific needs. You can even point it at other session’s transcript (just tell it which directory it runs in, and Claude should be able to find the .jsonl).
5. github-actions

   added

   staleIssue is inactiveIssue is inactive

   on Apr 23, 2026
6. github-actions commented on May 7, 2026

   

   github-actionsBot

   on May 7, 2026 – with GitHub Actions

   More actions

   Closing for now — inactive for too long. Please open a new issue if this is still relevant.
7. github-actions

   closed this as not plannedon May 7, 2026
8. github-actions commented on Jun 27, 2026

   

   github-actionsBot

   on Jun 27, 2026 – with GitHub Actions

   More actions

   This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.
9. github-actions

   locked as resolved and limited conversation to collaborators on Jun 27, 2026