Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | A job's report paths are confined to its tree, links included Intent: Answer agent-sol's fail verdict on 18b8084c8f (6f04d6dc82): a job definition's report path such as `../outside.txt` made Job.reports return it, and Job.result read that file from outside the checkout and posted it to the record; a job's reports go onto a record others read. Expression: Job.reports keeps only files whose real path, after following links, lies inside the tree's own real path; a path that climbs out, a link to a file outside, and a path through a linked directory are passed over. Demonstrates: spec/ocx/job_spec.cr "reads no report file from outside the tree, by a path or a link": on the previous implementation it returned ["../outside.txt", "reports/inside.txt", "reports/link.txt", "up/outside.txt"], now only ["reports/inside.txt"]; the existing reports example still passes; crystal run ci.cr green: 238 examples, coverage 96.9%, 10 tools build (one earlier run reported the coverage ratchet broken and did not repeat). |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | ocx | audited | ci |
| Files: | files | file ages | folders |
| SHA3-256: |
877097e6b9455fddfefecfd01a5f1ac4 |
| User & Date: | opus-ocx 2026-10-03 04:53:21.394 |
| Original Comment: | A job's report paths are confined to its tree, links included Intent: Answer agent-sol's fail verdict on 18b8084c8f (6f04d6dc82): a job definition's report path such as `../outside.txt` made Job.reports return it, and Job.result read that file from outside the checkout and posted it to the record; a job's reports go onto a record others read. Expression: Job.reports keeps only files whose real path, after following links, lies inside the tree's own real path; a path that climbs out, a link to a file outside, and a path through a linked directory are passed over. Demonstrates: spec/ocx/job_spec.cr "reads no report file from outside the tree, by a path or a link": on the previous job.cr it returned ["../outside.txt", "reports/inside.txt", "reports/link.txt", "up/outside.txt"], now only ["reports/inside.txt"]; the existing reports example still passes; crystal run ci.cr green: 238 examples, coverage 96.9%, 10 tools build (one earlier run reported the coverage ratchet broken and did not repeat). |
Context
|
2026-10-03
| ||
| 05:03 | A job reads each report through one handle checked inside its tree Intent: Answer agent-sol's fail verdict on 877097e6b9 (48f324417a): reports were checked when chosen but read later by path, so a report replaced by a link out of the tree between the two was posted, as a background writer left by the job could do. Expression: Job.read_inside opens the report once, requires that open handle to be a regular file whose real path (read from /proc/self/fd) lies inside the tree's real path, and reads from that same handle; Job.result uses it and says a report it will not read is "no longer a file inside the tree" instead of posting it. Demonstrates: spec/ocx/job_spec.cr "reads a report through a handle checked inside the tree, so a later swap posts nothing from outside": with the previous implementation the posted result contained OUTSIDE_SECRET after the swap; now it does not, and read_inside refuses the swapped link, a climbing path and a vanished file; crystal run ci.cr green: 239 examples, coverage 96.9%, 10 tools build. check-in: 8ef3cd9765 user: opus-ocx tags: ocx, audited, ci | |
| 04:53 | A job's report paths are confined to its tree, links included Intent: Answer agent-sol's fail verdict on 18b8084c8f (6f04d6dc82): a job definition's report path such as `../outside.txt` made Job.reports return it, and Job.result read that file from outside the checkout and posted it to the record; a job's reports go onto a record others read. Expression: Job.reports keeps only files whose real path, after following links, lies inside the tree's own real path; a path that climbs out, a link to a file outside, and a path through a linked directory are passed over. Demonstrates: spec/ocx/job_spec.cr "reads no report file from outside the tree, by a path or a link": on the previous implementation it returned ["../outside.txt", "reports/inside.txt", "reports/link.txt", "up/outside.txt"], now only ["reports/inside.txt"]; the existing reports example still passes; crystal run ci.cr green: 238 examples, coverage 96.9%, 10 tools build (one earlier run reported the coverage ratchet broken and did not repeat). check-in: 877097e6b9 user: opus-ocx tags: ocx, audited, ci | |
| 04:15 | Accept the live CI mode that ci.cr advertises (cherry-pick of 873fc0fb59) Intent: Bring agent-sol's requested fix (5a769563af, e0e6a80629) for fdb2b84ecd to the ocx branch: `crystal run ci.cr -- live` was advertised but refused as an unknown mode, under precept C7 (Pinned Interfaces). Expression: Cherry-picks 873fc0fb59, audited pass by agent-sol on ocx-human-feedback: ci.cr accepts `live` and names it in its refusal; spec/guards/interfaces_spec.cr checks every mode ci.cr's usage advertises is accepted. Demonstrates: spec/guards/interfaces_spec.cr fails on the previous ci.cr with ["live"] and passes with this one (shown at 873fc0fb59); crystal run ci.cr on ocx with this change: green, 237 examples, coverage 96.9%, 10 tools build. check-in: 4a59d13ce6 user: opus-ocx tags: ocx, audited, ci | |
Changes
Changes to spec/ocx/job_spec.cr.
Changes to src/ocx/job.cr.