mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-10-13 12:14:40 +00:00
Aaron VuandClaude Opus 4.7
1fad4e0b57
Addresses second review on #1174 (thieung): **B1 (blocking)** — first JSON content write into a fresh non-master tenant returned 500 because workspace/tenants/{slug}/ doesn't exist yet and EvalSymlinks fails with ErrNotExist. writeDocumentContent now MkdirAlls the workspace before resolving (mirrors handleUpload). Added a regression test that drives a non-master tenant context end-to-end and asserts the file lands under workspace/tenants/{slug}/. **I1** — replaced the Lstat→WriteFile sequence (TOCTOU window) with os.OpenFile(O_WRONLY|O_CREATE|O_TRUNC|O_NOFOLLOW). The Lstat short-fail stays as defense-in-depth + cleaner error logging. Portability handled via build-tagged constants in vault_handler_documents_nofollow_{unix, windows}.go — O_NOFOLLOW is no-op on Windows (desktop edition is single-user with no untrusted tenants). **I3** — every symlink/path-escape rejection now emits slog.Warn("security.vault_symlink_escape", ...) with the rejection site, resolved path and workspace, matching the storage.go pattern so oncall can alert on attempted escapes. **I4** — POST `content` field changed from `string` to `*string` to match PUT. Nil pointer = "no write" (metadata-only stub); empty string = "write a 0-byte file + fire event"; non-empty = write bytes. Updated handler godoc to spell out the symmetry. Switched `werr == os.ErrInvalid` to `errors.Is` per repo conventions. **Tests added** — non-master tenant first content write (B1), PUT with nil content (locks "no change" contract), handler-level ".." path rejection, POST content:"" writes empty file. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
21 lines
633 B
Go
21 lines
633 B
Go
//go:build !windows
|
|
|
|
package http
|
|
|
|
import (
|
|
"errors"
|
|
"syscall"
|
|
)
|
|
|
|
// oNoFollow is OR'd into the open flags so the kernel refuses to follow a
|
|
// symlink at the final path component — closes the Lstat→Open TOCTOU window
|
|
// where a tenant could swap a regular file for a symlink between the two
|
|
// syscalls. On Windows this is a no-op (see the _windows.go counterpart).
|
|
const oNoFollow = syscall.O_NOFOLLOW
|
|
|
|
// isSymlinkLoopErr reports whether err is the kernel's "refused to follow
|
|
// symlink" signal from an O_NOFOLLOW open (ELOOP on Linux/macOS).
|
|
func isSymlinkLoopErr(err error) bool {
|
|
return errors.Is(err, syscall.ELOOP)
|
|
}
|