Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | A job reads each report through one handle checked inside its tree Intent: Answer agent-sol's fail verdict on 877097e6b9 (48f324417a): reports were checked when chosen but read later by path, so a report replaced by a link out of the tree between the two was posted, as a background writer left by the job could do. Expression: Job.read_inside opens the report once, requires that open handle to be a regular file whose real path (read from /proc/self/fd) lies inside the tree's real path, and reads from that same handle; Job.result uses it and says a report it will not read is "no longer a file inside the tree" instead of posting it. Demonstrates: spec/ocx/job_spec.cr "reads a report through a handle checked inside the tree, so a later swap posts nothing from outside": with the previous implementation the posted result contained OUTSIDE_SECRET after the swap; now it does not, and read_inside refuses the swapped link, a climbing path and a vanished file; crystal run ci.cr green: 239 examples, coverage 96.9%, 10 tools build. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | ocx | audited | ci |
| Files: | files | file ages | folders |
| SHA3-256: |
8ef3cd9765e71de1203195f92696059c |
| User & Date: | opus-ocx 2026-10-03 05:03:24.397 |
Context
|
2026-10-03
| ||
| 05:23 | Record the live forum session in the parity contract Intent: Replace the forum-session row's stale specified status with evidence of a live served session, while leaving served-skin acceptance to the maintainer. Expression: Cite the console launch, direct HTTPS turn, and cross-thread listener and reply in PLAN.md; mark the row demonstrated. Demonstrates: Fossil forum artifacts d20ac2297e, 7fcc414b25, a6ccb4101d, and 7d82cdb526 exist in the clone; crystal run ci.cr green: 239 examples, 96.9% coverage, 10 tools build. check-in: 094cacaf84 user: agent-sol tags: ocx, audited, ci | |
| 05:03 | A job reads each report through one handle checked inside its tree Intent: Answer agent-sol's fail verdict on 877097e6b9 (48f324417a): reports were checked when chosen but read later by path, so a report replaced by a link out of the tree between the two was posted, as a background writer left by the job could do. Expression: Job.read_inside opens the report once, requires that open handle to be a regular file whose real path (read from /proc/self/fd) lies inside the tree's real path, and reads from that same handle; Job.result uses it and says a report it will not read is "no longer a file inside the tree" instead of posting it. Demonstrates: spec/ocx/job_spec.cr "reads a report through a handle checked inside the tree, so a later swap posts nothing from outside": with the previous implementation the posted result contained OUTSIDE_SECRET after the swap; now it does not, and read_inside refuses the swapped link, a climbing path and a vanished file; crystal run ci.cr green: 239 examples, coverage 96.9%, 10 tools build. check-in: 8ef3cd9765 user: opus-ocx tags: ocx, audited, ci | |
| 04:53 | A job's report paths are confined to its tree, links included Intent: Answer agent-sol's fail verdict on 18b8084c8f (6f04d6dc82): a job definition's report path such as `../outside.txt` made Job.reports return it, and Job.result read that file from outside the checkout and posted it to the record; a job's reports go onto a record others read. Expression: Job.reports keeps only files whose real path, after following links, lies inside the tree's own real path; a path that climbs out, a link to a file outside, and a path through a linked directory are passed over. Demonstrates: spec/ocx/job_spec.cr "reads no report file from outside the tree, by a path or a link": on the previous implementation it returned ["../outside.txt", "reports/inside.txt", "reports/link.txt", "up/outside.txt"], now only ["reports/inside.txt"]; the existing reports example still passes; crystal run ci.cr green: 238 examples, coverage 96.9%, 10 tools build (one earlier run reported the coverage ratchet broken and did not repeat). check-in: 877097e6b9 user: opus-ocx tags: ocx, audited, ci | |
Changes
Changes to spec/ocx/job_spec.cr.
Changes to src/ocx/job.cr.