openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-11-09 20:50:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden symlinked output and project config writes

Browse Source
This commit is contained in:
viyatb-oai
2026-05-04 10:53:04 -07:00
parent 5c1ec8f4fd
commit 32e9457d4b
7 changed files with 219 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/protocol/src/protocol.rs
+10
View File
@@ -4402,6 +4402,7 @@ mod tests {
let cwd = TempDir::new().expect("tempdir");
std::fs::create_dir_all(cwd.path().join(".agents")).expect("create .agents");
std::fs::create_dir_all(cwd.path().join(".codex")).expect("create .codex");
std::fs::write(cwd.path().join(".codex/config.toml"), "").expect("create config.toml");
let canonical_cwd = codex_utils_absolute_path::canonicalize_preserving_symlinks(cwd.path())
.expect("canonicalize cwd");
let cwd_absolute =
@@ -4413,6 +4414,9 @@ mod tests {
.expect("canonical .agents");
let expected_codex = AbsolutePathBuf::from_absolute_path(canonical_cwd.join(".codex"))
.expect("canonical .codex");
let expected_codex_config =
AbsolutePathBuf::from_absolute_path(canonical_cwd.join(".codex/config.toml"))
.expect("canonical .codex/config.toml");
let policy = FileSystemSandboxPolicy::restricted(vec![
FileSystemSandboxEntry {
path: FileSystemPath::Special {
@@ -4465,6 +4469,12 @@ mod tests {
.iter()
.any(|path| path.as_path() == expected_codex.as_path())
);
assert!(
writable_roots[0]
.read_only_subpaths
.iter()
.any(|path| path.as_path() == expected_codex_config.as_path())
);
}
#[test]