Problem
"curl *": ask placed after "curl * | sh*": deny causes curl ... | sh to match both patterns. Due to findLast (last-match-wins) semantics, ask wins over deny.
Fix
Move "curl *": ask BEFORE "curl * | sh*": deny in the permission block.
Ref
PR #100 inline review comment [2]
Problem
"curl *": askplaced after"curl * | sh*": denycausescurl ... | shto match both patterns. Due to findLast (last-match-wins) semantics,askwins overdeny.Fix
Move
"curl *": askBEFORE"curl * | sh*": denyin the permission block.Ref
PR #100 inline review comment [2]