opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): Symlink TOCTOU race condition

Browse source
This commit is contained in:
Goksu Ceylan 2026-02-19 08:46:39 -05:00
parent 213274002a
commit dd75f0b56e
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
pkg/tools/filesystem.go
View file

@ -43,6 +43,9 @@ func validatePath(path, workspace string, restrict bool) (string, error) {
if !isWithinWorkspace(resolved, workspaceReal) { if !isWithinWorkspace(resolved, workspaceReal) {
return "", fmt.Errorf("access denied: symlink resolves outside workspace") return "", fmt.Errorf("access denied: symlink resolves outside workspace")
} }
// Return the resolved path to prevent TOCTOU race
// the caller operates on the validated target directly.
absPath = resolved
} else if os.IsNotExist(err) { } else if os.IsNotExist(err) {
if parentResolved, err := resolveExistingAncestor(filepath.Dir(absPath)); err == nil { if parentResolved, err := resolveExistingAncestor(filepath.Dir(absPath)); err == nil {
if !isWithinWorkspace(parentResolved, workspaceReal) { if !isWithinWorkspace(parentResolved, workspaceReal) {