From 2995920a9024d4f3fddb20798da131b970ed9140 Mon Sep 17 00:00:00 2001 From: RuochenPan Date: Wed, 9 Sep 2026 09:18:33 +0800 Subject: [PATCH] test: check sandbox file readability across platforms --- tests/test_local_sandbox_access.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tests/test_local_sandbox_access.py b/tests/test_local_sandbox_access.py index 72b25cefe..9574316b4 100644 --- a/tests/test_local_sandbox_access.py +++ b/tests/test_local_sandbox_access.py @@ -51,7 +51,13 @@ async def test_managed_shell_output_cannot_be_redirected_outside_sandbox( from pathlib import Path secret = Path({str(secret)!r}) -assert not secret.exists(), "The host file must be outside the sandbox." +# Seatbelt allows metadata queries while denying access to file contents. +try: + secret.read_bytes() +except (FileNotFoundError, PermissionError): + pass +else: + raise AssertionError("The host file must not be readable inside the sandbox.") for log in Path({str(shared_temp)!r}).rglob("sh_*.log"): log.unlink() log.symlink_to(secret)