anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 18:25:32 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

[PR #8316] fix: prevent path traversal via symlinks and cross-drive paths #12703

New Issue
Open
opened 2026-02-16 18:17:36 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:17:36 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/anomalyco/opencode/pull/8316

State: open
Merged: No

Fixes #8313

Summary

Enhanced Filesystem.contains() to prevent directory escape attacks via symlinks and cross-drive paths on Windows.

Changes

  • src/util/filesystem.ts: Enhanced contains() function
    • Use realpathSync() to resolve symlinks to canonical paths
    • Add Windows cross-drive validation (check drive letters match)
    • Fallback to lexical check if path doesn't exist
  • src/file/index.ts: Removed resolved TODO comments (4 lines)

Security Improvements

Prevents symlink escape attacks
Prevents Windows cross-drive path bypass
Maintains backward compatibility

Testing

Tested on macOS (darwin-arm64):

  • Created symlink pointing outside project directory
  • Verified contains() correctly rejects escaped paths
  • Verified normal paths still work correctly

Test scenario

# Create test symlink
ln -s /etc/passwd ./packages/opencode/test-symlink

# Verify it's rejected by containsPath()
# Expected: Access denied error
**Original Pull Request:** https://github.com/anomalyco/opencode/pull/8316 **State:** open **Merged:** No --- Fixes #8313 ## Summary Enhanced `Filesystem.contains()` to prevent directory escape attacks via symlinks and cross-drive paths on Windows. ## Changes - **`src/util/filesystem.ts`**: Enhanced `contains()` function - Use `realpathSync()` to resolve symlinks to canonical paths - Add Windows cross-drive validation (check drive letters match) - Fallback to lexical check if path doesn't exist - **`src/file/index.ts`**: Removed resolved TODO comments (4 lines) ## Security Improvements Prevents symlink escape attacks Prevents Windows cross-drive path bypass Maintains backward compatibility ## Testing Tested on macOS (darwin-arm64): - Created symlink pointing outside project directory - Verified `contains()` correctly rejects escaped paths - Verified normal paths still work correctly ### Test scenario ```bash # Create test symlink ln -s /etc/passwd ./packages/opencode/test-symlink # Verify it's rejected by containsPath() # Expected: Access denied error
yindo added the pull-request label 2026-02-16 18:17:36 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#12703
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?