Code Weaver

Helps Laravel developers discover, compare, and choose open-source packages. See popularity, security, maintainers, and scores at a glance to make better decisions.

Web Terminal Laravel Package

mwguerra/web-terminal

View on GitHub

Deep Wiki

Context7

Shell Operator Controls

Date: 2026-03-06 Status: Approved

Problem

The terminal blocks all shell operators (pipes, redirection, chaining, expansion) unconditionally. Even with allowAllCommands(), users cannot run commands like ls | grep foo. There is no fluent API to control which operators are allowed.

Solution

Add granular fluent methods to control which shell operator groups are allowed, plus a global toggle.

Operator Groups

Method	Operators Unblocked	Risk
`allowPipes()`	`\|`	Low
`allowRedirection()`	`>`, `<`, `>>`, `<<`	Medium
`allowChaining()`	`;`, `&&`, `\|\|`	Medium
`allowExpansion()`	`$`, `, `$()`, `${}`, hex/octal escapes	High
`allowAllShellOperators()`	All of the above	High

Data Flow

Fluent API (Schema) → mount() params → Livewire properties → getSanitizer() → CommandSanitizer

Files Changed

src/Security/CommandSanitizer.php — group-aware filtering
src/Livewire/WebTerminal.php — new mount params + properties
src/Schemas/Components/WebTerminal.php — fluent methods
config/web-terminal.php — security.shell_operators section
README.md — documentation with risk explanations
Tests (unit + E2E)

Invariants (never relaxable)

Null byte (\x00) blocking
Newline/CR blocking

Weaver

How can I help you explore Laravel packages today?

Conversation history is not saved when not logged in.

Add packages to context

No packages found.

nexmo/api-specification

capell-app/block-library

axium/identity

cetria/laravel-dummy-models

cetria/reflection-helper

agropredict/sso-auth-bundle

evolvestudio/spam-protection

datacore/hub-sdk

develia/commons

cuci/prototurk-sdk

cuci/prototurk-sdk-symfony

develia/geo-bundle

dreamzy/livewire-charts

touchestate-sdk/php-sdk

ecotone/kafka

22h/doctrine-garbage-collection-bundle

agtp/agtp-php

agtp/mod-php

splash/sonata-admin

splash/metadata