github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 09:27:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: extract tmp media resolver helper and dedupe sandbox-path tests

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-22 00:45:39 +01:00
parent 8202582f4b
commit 55e38d3b44
2 changed files with 35 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/agents/sandbox-paths.test.ts
View File

@@ -18,6 +18,11 @@ async function expectSandboxRejection(media: string, sandboxRoot: string, patter
await expect(resolveSandboxedMediaSource({ media, sandboxRoot })).rejects.toThrow(pattern);
}
function isPathInside(root: string, target: string): boolean {
const relative = path.relative(path.resolve(root), path.resolve(target));
return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
}
describe("resolveSandboxedMediaSource", () => {
// Group 1: /tmp paths (the bug fix)
it.each([
@@ -94,9 +99,15 @@ describe("resolveSandboxedMediaSource", () => {
if (process.platform === "win32") {
return;
}
const outsideTmpTarget = path.resolve(process.cwd(), "package.json");
if (isPathInside(os.tmpdir(), outsideTmpTarget)) {
return;
}
await withSandboxRoot(async (sandboxDir) => {
await fs.access(outsideTmpTarget);
const symlinkPath = path.join(sandboxDir, "tmp-link-escape");
await fs.symlink("/etc/passwd", symlinkPath);
await fs.symlink(outsideTmpTarget, symlinkPath);
await expectSandboxRejection(symlinkPath, sandboxDir, /symlink|sandbox/i);
});
});