DetectTunnels blocks on a FIFO under wiki/, hanging brain_update and brain_write #174

New Issue

2026-10-05T05:03:30Z

mathias commented

2026-10-05 05:03:30 +00:00

Source: the PR #170 reviews, rounds 1 and 2 (comments 15038 and 15040). This was already true on main.

wikiUpkeep calls AutoTunnel, which calls DetectTunnels. DetectTunnels (via readTitleAndCreated) opens every wiki .md with a blocking os.Open. A FIFO named *.md anywhere under wiki/ therefore hangs a successful brain_update or brain_write with no deadline.

A FIFO can be planted by a Syncthing peer or by a local process. The symlinkguard tripwire does not remove FIFOs.

Fix: walk and read through brainfs.WalkRegular/ReadRegular, which skip non-regular files and open with O_NONBLOCK. This is the same treatment as the #157 slices.

Done when: a test with a no-reader FIFO under wiki/ shows that DetectTunnels returns within a timeout, and the test goes red with the blocking open restored.

Created via git-mcp on behalf of @mathias

**Source:** the PR #170 reviews, rounds 1 and 2 (comments 15038 and 15040). This was already true on main. `wikiUpkeep` calls `AutoTunnel`, which calls `DetectTunnels`. `DetectTunnels` (via `readTitleAndCreated`) opens every wiki `.md` with a blocking `os.Open`. A FIFO named `*.md` anywhere under `wiki/` therefore hangs a successful `brain_update` or `brain_write` with no deadline. A FIFO can be planted by a Syncthing peer or by a local process. The symlinkguard tripwire does not remove FIFOs. **Fix:** walk and read through `brainfs.WalkRegular`/`ReadRegular`, which skip non-regular files and open with `O_NONBLOCK`. This is the same treatment as the #157 slices. **Done when:** a test with a no-reader FIFO under `wiki/` shows that `DetectTunnels` returns within a timeout, and the test goes red with the blocking open restored. --- _Created via git-mcp on behalf of @mathias_

mathias added the risk/medium label 2026-10-05 05:03:30 +00:00

mathias referenced this issue

2026-10-05 05:09:13 +00:00

fix: brain_tunnel, brain_update and session_log confine caller-supplied paths (#169) #170

mathias referenced this issue

2026-10-05 05:09:14 +00:00

brain_tunnel: path traversal lets an MCP token holder rewrite any file the pod can write #169

mathias referenced this issue from a commit

2026-10-05 18:47:08 +00:00

fix: brain_tunnel, brain_update and session_log confine caller-supplied paths (#169) (#170)

mathias referenced this issue

2026-10-05 18:51:03 +00:00