mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Writes under brain/raw/ follow symlinks: processed/, rejected/, .processed markers, tunnel-candidates #158

New Issue
Open
opened 2026-10-03 14:57:17 +00:00 by mathias · 2 comments
mathias commented 2026-10-03 14:57:17 +00:00
Owner
Copy Link
Copy Source

Found by the PR #156 review, 2026-10-03. Pre-existing; PR #156 confines reads from raw/, not writes.

Reproduced:

  • a symlinked raw/processed: the watcher copies the note's contents outside raw/
  • a symlinked raw/rejected: RejectNote writes the note outside
  • a dangling symlink raw/m.md.processed: the watcher creates the target file outside

Read only: the tunnel-candidates-*.md append (internal/brain/tunnel.go:168) follows a symlink.

The watcher cases need no API call: a Syncthing peer plants the symlink and the next poll writes through it.

Fix: do every write under raw/ through the same os.Root (root.OpenFile/root.Mkdir/root.Create; os.Root refuses to traverse symlinks out of the root), and refuse a symlinked processed//rejected//failed/.

Done when: all four cases have a test that fails before the fix.

Created via git-mcp on behalf of @mathias

Found by the PR #156 review, 2026-10-03. Pre-existing; PR #156 confines *reads* from raw/, not writes. Reproduced: - a symlinked `raw/processed`: the watcher copies the note's contents outside raw/ - a symlinked `raw/rejected`: `RejectNote` writes the note outside - a dangling symlink `raw/m.md.processed`: the watcher creates the target file outside Read only: the `tunnel-candidates-*.md` append (`internal/brain/tunnel.go:168`) follows a symlink. The watcher cases need no API call: a Syncthing peer plants the symlink and the next poll writes through it. **Fix:** do every write under raw/ through the same `os.Root` (`root.OpenFile`/`root.Mkdir`/`root.Create`; os.Root refuses to traverse symlinks out of the root), and refuse a symlinked `processed/`/`rejected/`/`failed/`. **Done when:** all four cases have a test that fails before the fix. --- _Created via git-mcp on behalf of @mathias_
mathias added the risk/mediumsize/mtype/fix labels 2026-10-03 14:57:17 +00:00
mathias commented 2026-10-04 20:18:01 +00:00
Author
Owner
Copy Link
Copy Source

One more write path that follows symlinks, found while doing #157 slice 4: wiki.RebuildIndex (ingestion/internal/wiki/index.go) writes wiki/index.md with os.WriteFile. If wiki/index.md is a symlink (the brain is a Syncthing folder), the pipeline overwrites the symlink's target, which can be outside the brain. Fix it the same way as the other #158 writes: open the file through the brain root with O_NOFOLLOW, or write a temp file and rename it inside the root.

Created via git-mcp on behalf of @mathias

One more write path that follows symlinks, found while doing #157 slice 4: `wiki.RebuildIndex` (`ingestion/internal/wiki/index.go`) writes `wiki/index.md` with `os.WriteFile`. If `wiki/index.md` is a symlink (the brain is a Syncthing folder), the pipeline overwrites the symlink's target, which can be outside the brain. Fix it the same way as the other #158 writes: open the file through the brain root with O_NOFOLLOW, or write a temp file and rename it inside the root. --- _Created via git-mcp on behalf of @mathias_
mathias commented 2026-10-05 07:27:38 +00:00
Author
Owner
Copy Link
Copy Source

Write paths confirmed by execution in the PR #176 review (2026-10-05). Name them explicitly here:

  • pipeline.BackfillRefs: reads a regular concept page, a symlink is swapped in, and os.WriteFile(dest) follows it. The in-brain symlink target was overwritten about 5,000 times in 3 s. This was already the case on main.
  • pipeline.buildAndWrite (MkdirAll + os.WriteFile of every page) and wiki.AppendLog have the same shape.
  • provenance.ApplyFile: read-modify-write by path. Move it to brainfs.ReadRegular + WriteRegular once #170 lands.

A design point for the fix: reviseOrCreate now refuses a static symlinked page (#176), which aborts buildAndWrite partway. Earlier pages are written, the index rebuild and log append are skipped, and the watcher moves the source to failed/. Skip-with-warning per page may be better than aborting.

Created via git-mcp on behalf of @mathias

**Write paths confirmed by execution in the PR #176 review (2026-10-05). Name them explicitly here:** - **`pipeline.BackfillRefs`:** reads a regular concept page, a symlink is swapped in, and `os.WriteFile(dest)` follows it. The in-brain symlink target was overwritten about 5,000 times in 3 s. This was already the case on main. - **`pipeline.buildAndWrite`** (MkdirAll + `os.WriteFile` of every page) and **`wiki.AppendLog`** have the same shape. - **`provenance.ApplyFile`:** read-modify-write by path. Move it to `brainfs.ReadRegular` + `WriteRegular` once #170 lands. **A design point for the fix:** `reviseOrCreate` now refuses a static symlinked page (#176), which aborts `buildAndWrite` partway. Earlier pages are written, the index rebuild and log append are skipped, and the watcher moves the source to `failed/`. Skip-with-warning per page may be better than aborting. --- _Created via git-mcp on behalf of @mathias_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agent/ready
Meets the agent-ready contract; authorizes unattended execution
 blocked/client
Waiting on the client
 blocked/supplier
Waiting on a supplier
 blocked/upstream
Waiting on an upstream project or vendor
 risk/high
Irreversible, security-relevant, or control plane
 risk/low
Reversible, local, test-covered
 risk/medium
Touches shared state, deploys or data
 size/l
Too big - split it
 size/m
Under two days
 size/s
Under half a day
 size/xs
Under an hour
 status:dispatch
status:dispatched
status:review
status:reviewing
type/chore
Maintenance, no behaviour change
 type/decision
Human decision required; never agent/ready
 type/docs
Documentation only
 type/feat
New capability
 type/fix
Corrects broken behaviour
 type/ops
Infrastructure, deploy, runtime
 type/research
Investigate; output is a finding, not code
 type/test
Test coverage only
No labels risk/medium size/m type/fix
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot mathias
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mathias/hyperguild#158