pub fn check_blocklist(command: &str, blocklist: &[String]) -> Option<String>Expand description
Check if command matches any pattern in blocklist.
Returns the matched pattern string if the command is blocked, None otherwise.
The check is case-insensitive and handles common shell escape sequences.
Commands containing subshell metacharacters ($( or `) are always
blocked because nested evaluation cannot be safely analysed statically.