openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-19 17:28:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'codex/psec-4394-git-02-effective-patch-paths' into codex/psec-4394-git-03-path-containment

Browse Source
This commit is contained in:
Chris Bookholt
2026-07-01 15:51:09 -07:00
parent 17920f9a57 5045e45bf8
commit 48fde8c368
1 changed files with 17 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/git-utils/src/git_command_tests.rs
+17 -7
View File
@@ -62,8 +62,13 @@ fn write_git_candidate(directory: &Path) {
}
fn locations_for_root(root: &Path) -> UntrustedGitLocations {
let mut roots = vec![root.to_path_buf()];
push_unique(
&mut roots,
std::fs::canonicalize(root).expect("canonical root"),
);
UntrustedGitLocations {
roots: vec![std::fs::canonicalize(root).expect("canonical root")],
roots,
common_dirs: Vec::new(),
}
}
@@ -329,12 +334,17 @@ fn resolver_rejects_parent_traversal_spelled_through_repository() {
write_git_candidate(&trusted_bin);
let locations = locations_for_root(&repo);
let traversing_path = locations.roots[0].join("../trusted-bin");
let search_path = std::env::join_paths([traversing_path]).expect("PATH");
assert!(matches!(
GitRunner::from_search_path(&locations, &search_path),
Err(GitReadError::NoTrustedGit)
));
for root in &locations.roots {
let traversing_path = root.join("../trusted-bin");
let search_path = std::env::join_paths([traversing_path]).expect("PATH");
assert!(
matches!(
GitRunner::from_search_path(&locations, &search_path),
Err(GitReadError::NoTrustedGit)
),
"resolver accepted parent traversal from {root:?}"
);
}
}
#[cfg(windows)]