@@ -11,6 +11,7 @@ import type { SandboxFsBridge, SandboxFsStat, SandboxResolvedPath } from "./fs-b
1111import {
1212isPathInsideContainerRoot,
1313normalizeContainerPath as normalizeSandboxContainerPath,
14+relativePathEscapesContainerRoot,
1415} from "./path-utils.js";
15161617type ResolvedRemotePath = SandboxResolvedPath & {
@@ -67,8 +68,7 @@ class RemoteShellSandboxFsBridge implements SandboxFsBridge {
6768if (
6869relativePath === "" ||
6970relativePath === "." ||
70-relativePath.startsWith("..") ||
71-path.posix.isAbsolute(relativePath)
71+relativePathEscapesContainerRoot(relativePath)
7272) {
7373throw new Error(`Invalid sandbox entry target: ${target.containerPath}`);
7474}
@@ -124,7 +124,7 @@ class RemoteShellSandboxFsBridge implements SandboxFsBridge {
124124const target = this.resolveTarget(params);
125125this.ensureWritable(target, "create directories");
126126const relativePath = path.posix.relative(target.mountRootPath, target.containerPath);
127-if (relativePath.startsWith("..") || path.posix.isAbsolute(relativePath)) {
127+if (relativePathEscapesContainerRoot(relativePath)) {
128128throw new Error(
129129`Sandbox path escapes allowed mounts; cannot create directories: ${target.containerPath}`,
130130);
@@ -319,7 +319,7 @@ class RemoteShellSandboxFsBridge implements SandboxFsBridge {
319319320320private toResolvedPath(params: { mount: MountInfo; containerPath: string }): ResolvedRemotePath {
321321const relative = path.posix.relative(params.mount.containerRoot, params.containerPath);
322-if (relative.startsWith("..") || path.posix.isAbsolute(relative)) {
322+if (relativePathEscapesContainerRoot(relative)) {
323323throw new Error(
324324`Sandbox path escapes allowed mounts; cannot access: ${params.containerPath}`,
325325);
@@ -460,7 +460,7 @@ class RemoteShellSandboxFsBridge implements SandboxFsBridge {
460460);
461461}
462462const relativeParentPath = path.posix.relative(mount.containerRoot, canonicalParent);
463-if (relativeParentPath.startsWith("..") || path.posix.isAbsolute(relativeParentPath)) {
463+if (relativePathEscapesContainerRoot(relativeParentPath)) {
464464throw new Error(
465465`Sandbox path escapes allowed mounts; cannot ${params.action}: ${params.containerPath}`,
466466);
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。