From e31685c8cfc98f0ab119f14754e82b9a6e1a4f47 Mon Sep 17 00:00:00 2001
From: Goksu Ceylan <gceylan96@gmail.com>
Date: Thu, 19 Feb 2026 08:29:52 -0500
Subject: [PATCH] fix (security): custom deny patterns denying default patterns

---
 pkg/tools/shell.go | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go
index d9430672f..4de5996c7 100644
--- a/pkg/tools/shell.go
+++ b/pkg/tools/shell.go
@@ -80,6 +80,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
 		execConfig := config.Tools.Exec
 		enableDenyPatterns = execConfig.EnableDenyPatterns
 		if enableDenyPatterns {
+			denyPatterns = append(denyPatterns, defaultDenyPatterns...)  
 			if len(execConfig.CustomDenyPatterns) > 0 {
 				fmt.Printf("Using custom deny patterns: %v\n", execConfig.CustomDenyPatterns)
 				for _, pattern := range execConfig.CustomDenyPatterns {
@@ -90,8 +91,6 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf
 					}
 					denyPatterns = append(denyPatterns, re)
 				}
-			} else {
-				denyPatterns = append(denyPatterns, defaultDenyPatterns...)
 			}
 		} else {
 			// If deny patterns are disabled, we won't add any patterns, allowing all commands.