mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix(brainfs): refuse a file behind a symlinked directory for reads and writes (#173) #187

Merged
mathias merged 2 commits from fix/write-dir-redirect-173 into main 2026-10-05 20:17:37 +00:00
Conversation 2 Commits 2 Files Changed 7
+277 -7
2 Commits
Author SHA1 Message Date
mathiasandClaude Opus 5.5 9a288bea6f fix(brainfs,session): clean paths only; session logs open through the brain root (#173)
CI / Lint / Test / Vet (pull_request) Successful in 1m1s
Details
CI / Mirror to GitHub (pull_request) Skipped
Details 
Review round 1 on PR #187:

- realDir checked the cleaned parent while Lstat/OpenFile used the raw
  path; os.Root resolves ".." after following a symlink, so a ".." placed
  after a symlinked directory passed the check and redirected the read or
  write. ReadRegular, ReadRegularMax and WriteRegular now refuse a path
  that is not clean and local (ErrNotRegular). No current entry point
  reached it (callers clean first); the primitive no longer relies on that.
- session.Append checked the sessions dir with Lstat, then opened by plain
  path: a symlink swapped in between created logs outside the brain
  (29k in the reviewer's RENAME_EXCHANGE race). It now opens through an
  os.Root on the sessions dir's parent, so a swap can only redirect inside
  the brain (#167), and, since os.Root follows an in-root final symlink
  even with O_NOFOLLOW, writes only after confirming the path is the
  regular file it opened (Lstat + os.SameFile).
- Endpoint tests assert ErrorIs(brainfs.ErrNotRegular) and have positive
  controls.

golang.org/x/sys moves from indirect to direct (unix.Renameat2 in the
session race test); it was already in the module graph.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-05 21:08:47 +02:00
mathiasandClaude Opus 5.5 87dace37b1 fix(brainfs): refuse a file behind a symlinked directory for reads and writes (#173)
CI / Lint / Test / Vet (pull_request) Successful in 55s
Details
CI / Mirror to GitHub (pull_request) Skipped
Details 
os.Root follows an intermediate directory symlink that stays inside the
brain. A dir symlink inside wiki/ pointing elsewhere in the brain let
brain_update and brain_tunnel rewrite an existing .md there (e.g. under
raw/), and session_log followed a symlinked sessions dir.

- WriteRegular, ReadRegular and ReadRegularMax require every directory
  above the file to be a real directory (realDir). Reads too: brain_tunnel
  read the redirected target, then rewrote the source before the target's
  write was refused; and brain_read/brain_get could read another part of
  the brain through such a path.
- session.Append refuses a sessions dir that is not a real directory.
- A directory swapped in after the check remains the #167 residual.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-05 20:54:00 +02:00