opensource/WrenAI
3
0
Fork 0
mirror of https://github.com/Canner/WrenAI.git synced 2026-10-16 06:57:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(genbi): validate managed runtime symlinks portably

Browse Source
This commit is contained in:
Jax Liu
2026-09-07 13:27:49 +08:00
parent 4b2b30bd49
commit bbf3f03674
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/genbi/server/managed-wren-runtime.ts
+4 -1
View File
@@ -103,8 +103,11 @@ function assertSecureTree(root: string, code: ManagedWrenFailureCode): void {
const visit = (directory: string) => {
for (const name of readdirSync(directory)) {
const target = path.join(directory, name); const entry = lstatSync(target);
if ((entry.mode & 0o022) !== 0) failure(code);
// Symlink permission bits are not an access-control surface and differ by
// host filesystem (Linux commonly reports 0777). Validate their resolved
// target instead; enforce write bits on the actual files/directories.
if (entry.isSymbolicLink()) { assertContainedRealpath(root, target, code); continue; }
if ((entry.mode & 0o022) !== 0) failure(code);
if (entry.isDirectory()) visit(target); else if (!entry.isFile()) failure(code);
}
};