mirror of
https://github.com/openai/codex.git
synced 2026-11-06 20:20:34 +00:00
pakrym-oai
e3e5ad2847
## Why An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved. ## What changed - Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields. - Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files. - Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers. ## Testing - Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification. - Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points. GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd
71 lines
2.4 KiB
Rust
71 lines
2.4 KiB
Rust
use codex_connectors::parse_plugin_app_config;
|
|
use codex_core_plugins::ResolvedExecutorPlugin;
|
|
use codex_file_system::ReadFileOptions;
|
|
use codex_plugin::AppDeclaration;
|
|
use codex_plugin::PluginResourceLocator;
|
|
use codex_utils_path_uri::PathUri;
|
|
use std::io;
|
|
use thiserror::Error;
|
|
|
|
/// Loads connector declarations from a resolved plugin through its owning executor.
|
|
#[derive(Clone, Copy, Debug, Default)]
|
|
pub struct ExecutorPluginConnectorProvider;
|
|
|
|
/// Failure to load connector declarations from an executor plugin.
|
|
#[derive(Debug, Error)]
|
|
pub enum ExecutorPluginConnectorProviderError {
|
|
#[error("failed to read app config for selected plugin `{plugin_id}` at `{path}`: {source}")]
|
|
ReadConfig {
|
|
plugin_id: String,
|
|
path: PathUri,
|
|
#[source]
|
|
source: io::Error,
|
|
},
|
|
#[error("failed to parse app config for selected plugin `{plugin_id}` at `{path}`: {source}")]
|
|
ParseConfig {
|
|
plugin_id: String,
|
|
path: PathUri,
|
|
#[source]
|
|
source: serde_json::Error,
|
|
},
|
|
}
|
|
|
|
impl ExecutorPluginConnectorProvider {
|
|
/// Returns the connector declarations contributed by `plugin`.
|
|
#[tracing::instrument(name = "connectors.executor_plugin.declarations.load", skip_all)]
|
|
pub async fn load(
|
|
&self,
|
|
plugin: &ResolvedExecutorPlugin,
|
|
) -> Result<Vec<AppDeclaration>, ExecutorPluginConnectorProviderError> {
|
|
let resolved_plugin = plugin.plugin();
|
|
let plugin_id = resolved_plugin.selected_root_id();
|
|
let Some(PluginResourceLocator::Environment {
|
|
path: config_path, ..
|
|
}) = resolved_plugin.manifest().paths.apps.as_ref()
|
|
else {
|
|
return Ok(Vec::new());
|
|
};
|
|
let contents = plugin
|
|
.file_system()
|
|
.read_file_text(
|
|
config_path,
|
|
ReadFileOptions::default(),
|
|
/*sandbox*/ None,
|
|
)
|
|
.await
|
|
.map_err(|source| ExecutorPluginConnectorProviderError::ReadConfig {
|
|
plugin_id: plugin_id.to_string(),
|
|
path: config_path.clone(),
|
|
source,
|
|
})?;
|
|
|
|
parse_plugin_app_config(&contents).map_err(|source| {
|
|
ExecutorPluginConnectorProviderError::ParseConfig {
|
|
plugin_id: plugin_id.to_string(),
|
|
path: config_path.clone(),
|
|
source,
|
|
}
|
|
})
|
|
}
|
|
}
|