A shell tool that runs allowlisted binaries via execFile, never through
a shell, so there is no metacharacter interpolation. command must be a
bare name that is on the allowlist; anything containing a path separator is
rejected, so an allowlisted name cannot be satisfied by an arbitrary binary
at some path (e.g. /tmp/x/git).
A
shelltool that runs allowlisted binaries viaexecFile, never through a shell, so there is no metacharacter interpolation.commandmust be a bare name that is on the allowlist; anything containing a path separator is rejected, so an allowlisted name cannot be satisfied by an arbitrary binary at some path (e.g./tmp/x/git).