fix: brain_tunnel, brain_update and session_log confine caller-supplied paths (#169) #170

Merged

mathias merged 4 commits from fix/tunnel-traversal into main 2026-10-05 18:47:07 +00:00

Conversation 5 Commits 4 Files Changed 8

+526 -27

4 Commits

Author	SHA1	Message	Date
mathiasandClaude Opus 5.5	cce4dc3093	Merge origin/main into fix/tunnel-traversal (conflict-only) ... Conflict in ingestion/internal/brainfs/brainfs_test.go only: both sides appended a test after TestReadRegularNeverReturnsAnInBrainFileSwappedInBehindASymlink (this branch: TestWriteRegularRefusesFinalSymlinksFIFOsEscapesAndMissingFilesAndRewritesRegularFiles; main: TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents). Kept both, unchanged. No production code touched by the resolution. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 16:37:53 +02:00
mathiasandClaude Opus 5.5	6325c2b414	test(session): pin the id '/' ban and the FIFO O_NONBLOCK guard (#169) ... PR #170 round-2 review: both guards stayed green when removed. Adds an ErrInvalidID sentinel, a plain-prefix-then-'..' escape case asserted on the sentinel, and a no-reader FIFO case with a timeout. Flip-verified: allowing '/' in the id tail and dropping O_NONBLOCK each turn the suite red. Refs #169 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 06:54:23 +02:00
mathiasandClaude Opus 5.5	b3d782b25e	fix(update,session): brain_update and session_log confine caller paths (#169) ... Review round 1 on PR #170 found two more handlers with the #169 class of bug (verified by execution): - brain_update resolved its caller path with resolveWithin, a lexical containment check: any brain file could be superseded (classification.yaml, raw/, sessions/), and a final symlink was written through. UpdateNote now resolves like brain_edit (notes.Resolve, ScopeNotes: knowledge/ and wiki/ .md notes), and reads and rewrites through brainfs (ReadRegular, WriteRegular). - session_log joined the caller's session_id onto the sessions dir and opened it O_CREATE|O_APPEND: an id with path segments created or appended a .jsonl file anywhere the pod could write. The id must now be a plain name (^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$, which every live session file matches), and the open adds O_NOFOLLOW|O_NONBLOCK. Read checks the id too. - Tunnel tests: the .txt case now names an existing file (it failed on "missing" before), the symlink test adds an in-brain target, and the FIFO comment no longer claims the handle check is the only guard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 06:54:23 +02:00
mathiasandClaude Opus 5.5	e548b97ba4	fix(tunnel): brain_tunnel cannot write outside the wiki or through symlinks ... brain_tunnel passes caller-supplied source and target paths to WriteTunnel, which checked only the first segments ("wiki/<wing>/...") and joined them onto the brain dir. "wiki/b/x/../../../../tmp/f.md" resolved outside the brain, and appendSeeAlso read and rewrote that file (verified by execution): any MCP token holder could append to any existing file the pod user can write, inside the brain (raw/, sessions/, classification.yaml) or outside it. - checkNotePath: only a clean, local wiki/.../<slug>.md path, with no ".", ".." or empty segments. - Both notes are read and rewritten through brainfs. New brainfs.WriteRegular: never creates; Lstat through the root, open with O_NOFOLLOW|O_NONBLOCK, and require the opened handle to be the same regular file (os.SameFile). os.Root.OpenFile follows an in-root final symlink even with O_NOFOLLOW (verified on go1.27), so the flag alone does not refuse it. - The source is no longer rewritten when the target is refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 06:54:23 +02:00