Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-22 03:00:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(agentcompat): secure legacy file manager boundaries

Browse Source 
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
This commit is contained in:
naiba
2026-07-20 17:04:52 +00:00
co-authored by naiba/CloudCode
parent 029d458f50
commit 23763c8210
3 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration/agentcompat/internal/scenario/legacy_fm.go
+8 -6
View File
@@ -101,12 +101,14 @@ func (LegacyFM) Run(ctx context.Context, input LegacyFMInput) (result Result, ru
payload := bytes.Repeat(payloadPattern, (1<<20+257)/len(payloadPattern)+1)
payload = payload[:1<<20+257]
sentinel := []byte("outside-fm-root-sentinel")
sentinelPaths := []string{
filepath.Join(agentInstance.WorkspaceRoot(), "outside-fm-root-a.txt"),
filepath.Join(agentInstance.WorkspaceRoot(), "outside-fm-root-b.txt"),
workspaceRoot, err := os.OpenRoot(agentInstance.WorkspaceRoot())
if err != nil {
return finishLegacyFM(assertions, err)
}
for _, path := range sentinelPaths {
if err := os.WriteFile(path, sentinel, 0o600); err != nil {
defer workspaceRoot.Close()
sentinelNames := []string{"outside-fm-root-a.txt", "outside-fm-root-b.txt"}
for _, name := range sentinelNames {
if err := workspaceRoot.WriteFile(name, sentinel, 0o600); err != nil {
return finishLegacyFM(assertions, err)
}
}
@@ -252,7 +254,7 @@ func (LegacyFM) Run(ctx context.Context, input LegacyFMInput) (result Result, ru
return finishLegacyFM(assertions, err)
}
sentinelErr := verifyLegacyFMSentinels(sentinelPaths, sentinel)
sentinelErr := verifyLegacyFMSentinels(workspaceRoot, sentinelNames, sentinel)
assertions.Record("outside-root sentinels remain unchanged", sentinelErr == nil, errorText(sentinelErr))
if sentinelErr != nil {
return finishLegacyFM(assertions, sentinelErr)