openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-05 20:10:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): update deny-read test fixtures

Browse Source
This commit is contained in:
viyatb-oai
2026-03-09 18:48:29 -07:00
parent dcbbaeb993
commit 1c7a9ef035
3 changed files with 39 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/config/config_tests.rs
+2
View File
@@ -3504,6 +3504,7 @@ fn test_requirements_web_search_mode_allowlist_does_not_warn_when_unset() -> any
rules: None,
enforce_residency: None,
network: None,
permissions: None,
};
let requirement_source = crate::config_loader::RequirementSource::Unknown;
let requirement_source_for_error = requirement_source.clone();
@@ -4102,6 +4103,7 @@ async fn explicit_sandbox_mode_falls_back_when_disallowed_by_requirements() -> s
rules: None,
enforce_residency: None,
network: None,
permissions: None,
};
let config = ConfigBuilder::default()
codex-rs/core/src/exec_policy.rs
+33
View File
@@ -830,6 +830,10 @@ mod tests {
use crate::config_loader::ConfigRequirements;
use crate::config_loader::ConfigRequirementsToml;
use codex_app_server_protocol::ConfigLayerSource;
use codex_protocol::permissions::FileSystemAccessMode;
use codex_protocol::permissions::FileSystemPath;
use codex_protocol::permissions::FileSystemSandboxEntry;
use codex_protocol::permissions::FileSystemSandboxPolicy;
use codex_protocol::protocol::AskForApproval;
use codex_protocol::protocol::RejectConfig;
use codex_protocol::protocol::SandboxPolicy;
@@ -1240,6 +1244,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
command: &forbidden_script,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1290,6 +1295,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1317,6 +1323,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1345,6 +1352,7 @@ prefix_rule(pattern=["rm"], decision="forbidden")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: Some(requested_prefix.clone()),
})
@@ -1384,6 +1392,7 @@ prefix_rule(
],
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1413,6 +1422,7 @@ prefix_rule(
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1449,6 +1459,7 @@ prefix_rule(pattern=["git"], decision="allow")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1491,6 +1502,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1519,6 +1531,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: Some(vec!["cargo".to_string(), "install".to_string()]),
})
@@ -1552,6 +1565,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::Never,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1599,6 +1613,7 @@ prefix_rule(pattern=["git"], decision="prompt")
mcp_elicitations: false,
}),
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::RequireEscalated,
prefix_rule: None,
})
@@ -1635,6 +1650,7 @@ prefix_rule(pattern=["git"], decision="prompt")
mcp_elicitations: false,
}),
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::RequireEscalated,
prefix_rule: None,
})
@@ -1669,6 +1685,7 @@ prefix_rule(pattern=["git"], decision="prompt")
mcp_elicitations: false,
}),
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::RequireEscalated,
prefix_rule: None,
})
@@ -1692,6 +1709,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1716,6 +1734,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1744,6 +1763,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1772,6 +1792,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::RequireEscalated,
prefix_rule: Some(vec!["cargo".to_string(), "install".to_string()]),
})
@@ -1803,6 +1824,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::RequireEscalated,
prefix_rule: Some(vec!["cargo".to_string(), "install".to_string()]),
})
@@ -1841,6 +1863,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1915,6 +1938,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1945,6 +1969,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -1972,6 +1997,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -2010,6 +2036,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::UnlessTrusted,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -2033,6 +2060,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -2063,6 +2091,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -2275,6 +2304,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::DangerFullAccess,
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: SandboxPermissions::UseDefault,
prefix_rule: None,
})
@@ -2341,6 +2371,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &sneaky_command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: permissions,
prefix_rule: None,
})
@@ -2364,6 +2395,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &dangerous_command,
approval_policy: AskForApproval::OnRequest,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: permissions,
prefix_rule: None,
})
@@ -2383,6 +2415,7 @@ prefix_rule(pattern=["git"], decision="prompt")
command: &dangerous_command,
approval_policy: AskForApproval::Never,
sandbox_policy: &SandboxPolicy::new_read_only_policy(),
file_system_sandbox_policy: &FileSystemSandboxPolicy::default(),
sandbox_permissions: permissions,
prefix_rule: None,
})
codex-rs/core/src/filesystem_deny_read.rs
+4 -2
View File
@@ -277,8 +277,10 @@ mod tests {
std::fs::create_dir_all(denied.parent().expect("parent")).expect("create parent");
std::fs::write(&denied, "secret").expect("write secret");
let mut policy = FileSystemSandboxPolicy::default();
policy.deny_read_patterns = vec![format!("{}/private/secret?.txt", temp.path().display())];
let policy = FileSystemSandboxPolicy {
deny_read_patterns: vec![format!("{}/private/secret?.txt", temp.path().display())],
..Default::default()
};
assert_eq!(is_read_denied(&denied, &policy, temp.path()), true);
assert_eq!(