openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-06 15:29:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reject Windows proxies without elevated sandbox

Browse Source
This commit is contained in:
David Wiesen
2026-07-07 12:11:02 -07:00
parent aab8d9b365
commit c32b50beb7
2 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
codex-rs/core/src/config/config_tests.rs
View File

@@ -173,25 +173,29 @@ fn windows_network_proxy_requires_elevated_only_sandbox_requirement() {
#[test]
fn windows_network_proxy_requires_elevated_sandbox() {
let err = validate_windows_sandbox_network_proxy_compatibility_for_platform(
/*is_windows*/ true,
for windows_sandbox_level in [
WindowsSandboxLevel::Disabled,
WindowsSandboxLevel::RestrictedToken,
/*network_proxy_configured*/ true,
)
.expect_err("unelevated Windows sandbox should reject configured network proxy");
] {
let err = validate_windows_sandbox_network_proxy_compatibility_for_platform(
/*is_windows*/ true,
windows_sandbox_level,
/*network_proxy_configured*/ true,
)
.expect_err("non-elevated Windows sandbox should reject configured network proxy");
assert!(matches!(
err.get_ref()
.and_then(|source| source.downcast_ref::<ConstraintError>()),
Some(ConstraintError::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox)
));
assert!(matches!(
err.get_ref()
.and_then(|source| source.downcast_ref::<ConstraintError>()),
Some(ConstraintError::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox)
));
}
}
#[test]
fn windows_network_proxy_compatibility_allows_valid_combinations() -> std::io::Result<()> {
for (windows_sandbox_level, network_proxy_configured) in [
(WindowsSandboxLevel::Disabled, false),
(WindowsSandboxLevel::Disabled, true),
(WindowsSandboxLevel::RestrictedToken, false),
(WindowsSandboxLevel::Elevated, false),
(WindowsSandboxLevel::Elevated, true),

2
codex-rs/core/src/config/mod.rs
View File

@@ -615,7 +615,7 @@ fn validate_windows_sandbox_network_proxy_compatibility_for_platform(
) -> std::io::Result<()> {
if is_windows
&& network_proxy_configured
&& windows_sandbox_level == WindowsSandboxLevel::RestrictedToken
&& windows_sandbox_level != WindowsSandboxLevel::Elevated
{
return Err(ConstraintError::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox.into());
}