<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>权限绕过 :: 标签 :: x7peeps</title><link>https://x7peeps.com/tags/%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87/index.html</link><description/><generator>Hugo</generator><language>zh-CN</language><lastBuildDate>Tue, 10 Nov 2026 01:28:57 +0800</lastBuildDate><atom:link href="https://x7peeps.com/tags/%E6%9D%83%E9%99%90%E7%BB%95%E8%BF%87/index.xml" rel="self" type="application/rss+xml"/><item><title>Gemini CLI 的只读白名单漏了参数：一个 git diff 就能静默覆盖任意文件</title><link>https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%8F%AA%E8%AF%BB%E7%99%BD%E5%90%8D%E5%8D%95%E6%BC%8F%E4%BA%86%E5%8F%82%E6%95%B0git-diff%E9%9D%99%E9%BB%98%E8%A6%86%E7%9B%96%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6/index.html</link><pubDate>Tue, 10 Nov 2026 01:28:57 +0800</pubDate><guid>https://x7peeps.com/%E5%AE%89%E5%85%A8/%E5%8F%AA%E8%AF%BB%E7%99%BD%E5%90%8D%E5%8D%95%E6%BC%8F%E4%BA%86%E5%8F%82%E6%95%B0git-diff%E9%9D%99%E9%BB%98%E8%A6%86%E7%9B%96%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6/index.html</guid><description>Gemini CLI 把 git diff 列进了只读命令白名单，于是执行它时跳过 [Y/n] 权限确认。问题在于白名单只认子命令名，不看参数——git diff --no-index --output=&lt;path&gt; 可以在任意路径上截断或覆盖目标文件，全程不弹任何提示。</description></item></channel></rss>