@@ -136,7 +136,7 @@ describe("assertCanonicalPathWithinBase", () => {
136136candidatePath: path.join(baseFile, "child"),
137137boundaryLabel: "install directory",
138138}),
139-).rejects.toThrow(/base directory must be a real directory/i);
139+).rejects.toThrow(/base directory must be a directory/i);
140140});
141141});
142142@@ -173,19 +173,43 @@ describe("assertCanonicalPathWithinBase", () => {
173173},
174174);
175175176-it.runIf(process.platform !== "win32")("rejects symlinked base directories", async () => {
177-await withTempDir({ prefix: "openclaw-install-safe-" }, async (parentDir) => {
178-const realBaseDir = path.join(parentDir, "real-base");
179-const symlinkBaseDir = path.join(parentDir, "base-link");
180-await fs.mkdir(realBaseDir, { recursive: true });
181-await fs.symlink(realBaseDir, symlinkBaseDir);
182-await expect(
183-assertCanonicalPathWithinBase({
184-baseDir: symlinkBaseDir,
185-candidatePath: path.join(symlinkBaseDir, "tool"),
186-boundaryLabel: "install directory",
187-}),
188-).rejects.toThrow(/base directory must be a real directory/i);
189-});
190-});
176+it.runIf(process.platform !== "win32")(
177+"accepts symlinked base directories when the target stays in the real base",
178+async () => {
179+await withTempDir({ prefix: "openclaw-install-safe-" }, async (parentDir) => {
180+const realBaseDir = path.join(parentDir, "real-base");
181+const symlinkBaseDir = path.join(parentDir, "base-link");
182+await fs.mkdir(realBaseDir, { recursive: true });
183+await fs.symlink(realBaseDir, symlinkBaseDir);
184+await expect(
185+assertCanonicalPathWithinBase({
186+baseDir: symlinkBaseDir,
187+candidatePath: path.join(symlinkBaseDir, "tool"),
188+boundaryLabel: "install directory",
189+}),
190+).resolves.toBeUndefined();
191+});
192+},
193+);
194+195+it.runIf(process.platform !== "win32")(
196+"rejects nested symlinked candidate directories",
197+async () => {
198+await withTempDir({ prefix: "openclaw-install-safe-" }, async (parentDir) => {
199+const realBaseDir = path.join(parentDir, "base");
200+const nestedRealDir = path.join(parentDir, "nested-real");
201+const nestedSymlinkDir = path.join(realBaseDir, "nested-link");
202+await fs.mkdir(realBaseDir, { recursive: true });
203+await fs.mkdir(nestedRealDir, { recursive: true });
204+await fs.symlink(nestedRealDir, nestedSymlinkDir);
205+await expect(
206+assertCanonicalPathWithinBase({
207+baseDir: realBaseDir,
208+candidatePath: path.join(nestedSymlinkDir, "tool"),
209+boundaryLabel: "install directory",
210+}),
211+).rejects.toThrow(/must stay within install directory/i);
212+});
213+},
214+);
191215});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。