tiennm99/goclaw
1
0 Fork 0
mirror of https://github.com/tiennm99/goclaw.git synced 2026-10-20 02:17:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden upstream critical surfaces (#32)

Browse Source 
* fix(security): harden upstream critical surfaces

Refs #30

* fix(security): close pre-landing review gaps

Refs #30

* fix(security): close official release blockers
This commit is contained in:
Duy /zuey/ authored and GitHub committed 2026-05-20 16:33:49 +07:00
1 parent 2a48e62c6b
commit 532ff91d8e
59 files changed
+2194 -397
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/tools/filesystem_write.go
+8 -9
View File
@@ -15,8 +15,8 @@ import (
type WriteFileTool struct {
workspace string
restrict bool
allowedPrefixes []string // extra allowed path prefixes (cross-drive on Windows)
deniedPrefixes []string // path prefixes to deny access to (e.g. .goclaw)
allowedPrefixes []string // extra allowed path prefixes (cross-drive on Windows)
deniedPrefixes []string // path prefixes to deny access to (e.g. .goclaw)
sandboxMgr sandbox.Manager
contextFileIntc *ContextFileInterceptor // nil = no virtual FS routing
memIntc *MemoryInterceptor // nil = no memory routing
@@ -240,15 +240,14 @@ func (t *WriteFileTool) Execute(ctx context.Context, args map[string]any) *Resul
}
func (t *WriteFileTool) executeInSandbox(ctx context.Context, path, content, sandboxKey string, deliver, appendMode bool) *Result {
bridge, err := t.getFsBridge(ctx, sandboxKey)
if err != nil {
return ErrorResult(fmt.Sprintf("sandbox error: %v", err))
}
containerCwd, cwdErr := SandboxCwd(ctx, t.workspace, sandbox.DefaultContainerWorkdir)
if cwdErr != nil {
return ErrorResult(fmt.Sprintf("sandbox path mapping: %v", cwdErr))
}
bridge, err := t.getFsBridge(ctx, sandboxKey, containerCwd)
if err != nil {
return ErrorResult(fmt.Sprintf("sandbox error: %v", err))
}
containerPath := ResolveSandboxPath(path, containerCwd)
if err := bridge.WriteFile(ctx, containerPath, content, appendMode); err != nil {
@@ -284,10 +283,10 @@ func (t *WriteFileTool) executeInSandbox(ctx context.Context, path, content, san
return result
}
func (t *WriteFileTool) getFsBridge(ctx context.Context, sandboxKey string) (*sandbox.FsBridge, error) {
func (t *WriteFileTool) getFsBridge(ctx context.Context, sandboxKey, containerCwd string) (*sandbox.FsBridge, error) {
sb, err := t.sandboxMgr.Get(ctx, sandboxKey, t.workspace, SandboxConfigFromCtx(ctx))
if err != nil {
return nil, err
}
return sandbox.NewFsBridge(sb.ID(), sandbox.DefaultContainerWorkdir), nil
return sandbox.NewFsBridge(sb.ID(), containerCwd), nil
}