go/pkg/io
Snider cbaa114bb2
Some checks are pending
Auto Merge / merge (pull_request) Waiting to run
CI / qa (pull_request) Waiting to run
Coverage / coverage (pull_request) Waiting to run
PR Build / build (amd64, linux, ubuntu-latest) (pull_request) Waiting to run
PR Build / draft-release (pull_request) Blocked by required conditions
fix(io/local): resolve symlinks on sandbox root to prevent false escape detection
On macOS, /var is a symlink to /private/var. When New() stores the
unresolved root but validatePath() resolves child paths via EvalSymlinks,
the mismatch causes filepath.Rel to produce ".." prefixes — triggering
false SECURITY sandbox escape warnings on every file operation.

Fix: resolve symlinks on the root path in New() so both sides compare
like-for-like. Updates TestNew to compare against resolved paths.

Co-Authored-By: Virgil <virgil@lethean.io>
2026-02-19 14:20:39 +00:00
..
local fix(io/local): resolve symlinks on sandbox root to prevent false escape detection 2026-02-19 14:20:39 +00:00
client_test.go feat: infrastructure packages and lint cleanup (#281) 2026-02-04 11:34:43 +00:00
io.go Migrate pkg/build to io.Medium abstraction (#287) 2026-02-04 17:59:10 +00:00