github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-10 12:14:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(test): use NTFS junctions and platform guards for symlink tests on Windows (openclaw#28747) thanks @arosstale

Browse Source 
Verified:
- pnpm install --frozen-lockfile
- pnpm test src/agents/apply-patch.test.ts src/agents/sandbox/fs-bridge.test.ts src/agents/sandbox/validate-sandbox-security.test.ts src/infra/archive.test.ts

Co-authored-by: arosstale <117890364+arosstale@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
This commit is contained in:
Artale
2026-03-02 17:45:19 +01:00
committed by GitHub
parent 18f8393b6c
commit 1b462ed174
5 changed files with 41 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/agents/sandbox/fs-bridge.test.ts
View File

@@ -308,6 +308,10 @@ describe("sandbox fs bridge shell compatibility", () => {
it("rejects pre-existing host symlink escapes before docker exec", async () => {
await withTempDir("openclaw-fs-bridge-", async (stateDir) => {
const { workspaceDir, outsideFile } = await createHostEscapeFixture(stateDir);
// File symlinks require SeCreateSymbolicLinkPrivilege on Windows.
if (process.platform === "win32") {
return;
}
await fs.symlink(outsideFile, path.join(workspaceDir, "link.txt"));
const bridge = createSandboxFsBridge({

17
src/agents/sandbox/validate-sandbox-security.test.ts
View File

@@ -103,17 +103,22 @@ describe("validateBindMounts", () => {
});
it("blocks symlink escapes into blocked directories", () => {
const dir = mkdtempSync(join(tmpdir(), "openclaw-sbx-"));
const link = join(dir, "etc-link");
symlinkSync("/etc", link);
const run = () => validateBindMounts([`${link}/passwd:/mnt/passwd:ro`]);
if (process.platform === "win32") {
// Windows source paths (e.g. C:\...) are intentionally rejected as non-POSIX.
// Symlinks to non-existent targets like /etc require
// SeCreateSymbolicLinkPrivilege on Windows. The Windows branch of this
// test does not need a real symlink — it only asserts that Windows source
// paths are rejected as non-POSIX.
const dir = mkdtempSync(join(tmpdir(), "openclaw-sbx-"));
const fakePath = join(dir, "etc-link", "passwd");
const run = () => validateBindMounts([`${fakePath}:/mnt/passwd:ro`]);
expect(run).toThrow(/non-absolute source path/);
return;
}
const dir = mkdtempSync(join(tmpdir(), "openclaw-sbx-"));
const link = join(dir, "etc-link");
symlinkSync("/etc", link);
const run = () => validateBindMounts([`${link}/passwd:/mnt/passwd:ro`]);
expect(run).toThrow(/blocked path/);
});