pub fn detect_allowlist_bypass(allowed: &[String]) -> Vec<String>Expand description
Return the deduplicated allowlist entries that make a code_writer allowlist
bypassable (see SHELL_SPAWNING_COMMANDS).
The allowlist matches on command name, so we compare the basename of each
entry’s first whitespace-delimited token: find, /usr/bin/find and
find -exec rm {} + all resolve to find.