mirror of
https://github.com/openai/codex.git
synced 2026-11-06 20:20:34 +00:00
viyatb-oai
636cdcb7ec
## Why `codex exec --output-last-message` wrote through a pathname after tools finished, allowing sandbox activity to redirect the final write by replacing that path with a symlink. The related risk is described in https://github.com/openai/codex/pull/25956. ## What changed - Open the destination before starting the agent and retain its handle until the final write. - Reject symlinks, Windows reparse points, and multiply linked files; verify that the pathname still identifies the bound file before truncating and after writing. - Propagate output errors so the command fails when the destination cannot be opened or written safely. - Preserve inherited Unix output streams, FIFOs, devices, and Windows `NUL` support, while avoiding duplicate final answers when human output targets stdout. ## Testing Add regression coverage for sandbox-created symlinks across consecutive invocations, redirected stdout, delayed truncation, hard links, replaced paths, and Windows stream binding and filesystem identity checks. GitOrigin-RevId: 4a31bd28a5eb2d0a9e200cb658eb7d19dc93e933
25 lines
525 B
Rust
25 lines
525 B
Rust
// Aggregates all former standalone integration tests as modules.
|
|
mod add_dir;
|
|
mod agents_md;
|
|
mod apply_patch;
|
|
mod approval_policy;
|
|
mod auth_env;
|
|
#[path = "completion_backfill_tests.rs"]
|
|
mod completion_backfill;
|
|
#[path = "cyber_access_program_tests.rs"]
|
|
mod cyber_access_program;
|
|
mod daybreak;
|
|
mod ephemeral;
|
|
mod hooks;
|
|
mod mcp_required_exit;
|
|
mod originator;
|
|
mod output_last_message;
|
|
mod output_schema;
|
|
mod prompt_stdin;
|
|
mod resume;
|
|
mod sandbox;
|
|
#[cfg(target_os = "macos")]
|
|
mod seatbelt;
|
|
mod server_error_exit;
|
|
mod worktree;
|