Reject path components in internal command names

[p-linnane]

Both brew.sh and Commands.valid_internal_cmd? resolved internal command names by joining them onto the cmd and dev-cmd directories, so a name containing path components could select a file outside those directories before any tap trust check ran. Reject names containing /, . or .. in brew.sh as soon as the command name is known, before the developer-command classification, and in one Ruby check behind valid_internal_cmd?, valid_internal_dev_cmd? and Commands.path, with two-way comments keeping both in sync.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

GPT-6 Astra and Claude Code (Fable 5.1) drafted the implementation and tests; I reviewed the diff, verified the new tests fail without the change and pass with it, and ran brew lgtm --online plus targeted specs.

---

[Copilot]

🟡 Changes recommended

Internal-command paths remain reachable through validation gaps, and rejected names can still trigger developer-command side effects.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Hardens internal command resolution by rejecting command names containing path components.

Changes:

• Adds Ruby and Bash command-name validation.
• Adds regression tests for invalid internal command names.

File summaries

File	Review
Library/Homebrew/test/commands_spec.rb	Adds validator tests, but lacks exact . and .. cases.
Library/Homebrew/commands.rb	Adds validation, but Commands.path still bypasses it.
Library/Homebrew/brew.sh	Adds dispatch guards, but validation occurs after side effects and still accepts exact . and ...

Review details

Suppressed comments (2)

Library/Homebrew/brew.sh:597

• The developer-command predicate also accepts . and .., so it is not in sync with valid_internal_dev_cmd? and can select dev-cmd/..sh or dev-cmd/...sh. Apply the same explicit exclusions in this branch.

elif [[ -z "${HOMEBREW_FORCE_RUBY_COMMAND:-}" && "${HOMEBREW_COMMAND}" != */* &&
        -f "${HOMEBREW_LIBRARY}/Homebrew/dev-cmd/${HOMEBREW_COMMAND}.sh" ]]

Library/Homebrew/test/commands_spec.rb:48

• The new examples only pass ../other, so they exercise the slash short-circuit but never the newly added ./.. branch. Add parameterised cases for the exact dot components for both validators; otherwise removing %w[. ..].include?(cmd) leaves this test suite green.

    expect(described_class.valid_internal_cmd?("../other")).to be(false)
  end

• Files reviewed: 3/3 changed files
• Comments generated: 3
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[MikeMcQuaid]

Thanks!