Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 09:40:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(agentcompat): root filesystem guard reads

Browse Source 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
This commit is contained in:
naiba
2026-07-20 17:05:10 +00:00
co-authored by naiba/CloudCode
parent 23763c8210
commit 20930aaf9f
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration/agentcompat/internal/scenario/mcp_filesystem_safety.go
+11 -5
View File
@@ -31,7 +31,13 @@ func verifyMCPFilesystemPathGuards(ctx context.Context, assertions *AssertionSet
if err := os.Symlink(symlinkFinalTarget, filepath.Join(filesystem.root.Absolute(), "linked-final")); err != nil {
return err
}
before, err := filesystemTargetHashes(directTarget, symlinkParentTarget, symlinkFinalTarget)
root, err := os.OpenRoot(fixtureParent)
if err != nil {
return err
}
defer root.Close()
targetNames := []string{"outside-sentinel", "outside-directory/parent-target.txt", "final-target.txt"}
before, err := filesystemTargetHashes(root, targetNames...)
if err != nil {
return err
}
@@ -64,7 +70,7 @@ func verifyMCPFilesystemPathGuards(ctx context.Context, assertions *AssertionSet
}
requestsAfter := filesystem.client.RequestCount()
dispatched := int64(requestsAfter) - int64(requestsBefore)
after, err := filesystemTargetHashes(directTarget, symlinkParentTarget, symlinkFinalTarget)
after, err := filesystemTargetHashes(root, targetNames...)
if err != nil {
return err
}
@@ -79,10 +85,10 @@ func verifyMCPFilesystemPathGuards(ctx context.Context, assertions *AssertionSet
return nil
}
func filesystemTargetHashes(paths ...string) ([32]byte, error) {
func filesystemTargetHashes(root *os.Root, names ...string) ([32]byte, error) {
hash := sha256.New()
for _, path := range paths {
content, err := os.ReadFile(path)
for _, name := range names {
content, err := root.ReadFile(name)
if err != nil {
return [32]byte{}, err
}