From f969d97c1696bbe8941f6d366cc2250ecbeb1e57 Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 5 Oct 2026 07:20:59 +0200 Subject: [PATCH] test(notes): in-brain symlink target for ReadScoped, the sixth slice 1-3 caller Review of #172 (finding 1): notes.ReadScoped (brain_read, slice 2) had only outside-brain targets, which os.Root refuses on its own, so a reader bypassing brainfs's Lstat/SameFile stayed green. Adds a static in-brain link, a positive control and an in-brain swap race. Flip: replacing ReadRegularMax with os.OpenRoot().ReadFile turns it red 3/3. Co-Authored-By: Claude Opus 5.5 --- ingestion/internal/notes/read_root_test.go | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/ingestion/internal/notes/read_root_test.go b/ingestion/internal/notes/read_root_test.go index a699fd4..eaa970b 100644 --- a/ingestion/internal/notes/read_root_test.go +++ b/ingestion/internal/notes/read_root_test.go @@ -38,3 +38,31 @@ func TestReadScopedRefusesANoteOverMaxNoteBytes(t *testing.T) { _, err := ReadScoped(brain, "wiki/w/facts/big.md", ScopeNotes) assert.ErrorIs(t, err, ErrTooLarge) } + +// hyperguild#171 (review of #172, finding 1): os.Root alone refuses links that +// leave the brain, so the outside-target race above stays green for a reader +// that skips brainfs's Lstat and SameFile checks. An in-brain target (raw/, +// outside ScopeNotes) is what tells them apart. +func TestReadScopedDoesNotReturnAnInBrainSymlinkTargetStaticallyOrDuringASampledSwapRace(t *testing.T) { + brain := t.TempDir() + facts := filepath.Join(brain, "wiki", "w", "facts") + require.NoError(t, os.MkdirAll(facts, 0o755)) + target := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md")) + + require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md"))) + b, err := ReadScoped(brain, "wiki/w/facts/inlink.md", ScopeNotes) + assert.Error(t, err, "static in-brain link") + assert.NotContains(t, string(b), brainfstest.Sentinel, "static in-brain link") + + p := filepath.Join(facts, "r.md") + require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644)) + b, err = ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes) + require.NoError(t, err) + assert.Equal(t, "inside", string(b), "positive control: a regular note reads") + + read := func() string { + b, _ := ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes) + return string(b) + } + brainfstest.AssertNoLeakFrom(t, p, "inside", target, 1500*time.Millisecond, read) +}