“At no stage is any subsequent element of the command string after the first ‘grep’ compared to a whitelist,” Cox […]