openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-31 19:28:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: fix CI expectations after symlink hardening

Browse Source 
Co-authored-by: Codex <noreply@openai.com>
This commit is contained in:
viyatb-oai
2026-05-04 10:53:05 -07:00
co-authored by Codex
parent e7dbedf6f1
commit fa61db6c33
2 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/core/src/config/config_loader_tests.rs
+8 -2
View File
@@ -2083,7 +2083,13 @@ async fn symlinked_project_config_is_rejected() -> std::io::Result<()> {
tokio::fs::write(project_root.join(".git"), "gitdir: here").await?;
tokio::fs::write(&payload, "sandbox_mode = \"danger-full-access\"\n").await?;
symlink(&payload, dot_codex.join(CONFIG_TOML_FILE)).expect("create config symlink");
make_config_for_test(&codex_home, &project_root, TrustLevel::Trusted, None).await?;
make_config_for_test(
&codex_home,
&project_root,
TrustLevel::Trusted,
/*project_root_markers*/ None,
)
.await?;
let err = ConfigBuilder::default()
.codex_home(codex_home)
@@ -2230,7 +2236,7 @@ async fn project_root_markers_supports_alternate_markers() -> std::io::Result<()
&codex_home,
&project_root,
TrustLevel::Trusted,
Some(vec![".hg".to_string()]),
/*project_root_markers*/ Some(vec![".hg".to_string()]),
)
.await?;
codex-rs/linux-sandbox/src/bwrap.rs
+4 -5
View File
@@ -2226,7 +2226,7 @@ mod tests {
#[cfg(unix)]
#[test]
fn split_policy_masks_symlinked_project_config_file() {
fn split_policy_remounts_symlinked_project_config_target_read_only() {
let temp_dir = TempDir::new().expect("temp dir");
let writable_root = temp_dir.path().join("workspace");
let dot_codex = writable_root.join(".codex");
@@ -2235,10 +2235,9 @@ mod tests {
std::fs::create_dir_all(&dot_codex).expect("create .codex");
std::fs::write(&payload, "sandbox_mode = \"danger-full-access\"").expect("write payload");
std::os::unix::fs::symlink(&payload, &config).expect("create config symlink");
let payload_str = path_to_string(&payload);
let writable_root =
AbsolutePathBuf::from_absolute_path(&writable_root).expect("absolute writable root");
let config = AbsolutePathBuf::from_absolute_path(&config).expect("absolute config");
let config_str = path_to_string(config.as_path());
let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
path: FileSystemPath::Path {
path: writable_root,
@@ -2251,8 +2250,8 @@ mod tests {
assert!(
args.args
.windows(3)
.any(|window| window == ["--ro-bind", "/dev/null", config_str.as_str()]),
"expected symlinked config.toml to be masked: {:#?}",
.any(|window| window == ["--ro-bind", payload_str.as_str(), payload_str.as_str()]),
"expected symlinked config.toml target to be remounted read-only: {:#?}",
args.args
);
}