HAL9000
5fca547fda
CI / benchmark-publish (pull_request) Has been skipped
CI / push-validation (pull_request) Successful in 28s
CI / helm (pull_request) Successful in 46s
CI / lint (pull_request) Failing after 1m10s
CI / build (pull_request) Successful in 55s
CI / quality (pull_request) Successful in 1m9s
CI / unit_tests (pull_request) Failing after 1m19s
CI / typecheck (pull_request) Successful in 1m31s
CI / security (pull_request) Successful in 1m37s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / integration_tests (pull_request) Successful in 4m3s
CI / e2e_tests (pull_request) Failing after 4m29s
CI / status-check (pull_request) Failing after 3s
CI / benchmark-regression (pull_request) Failing after 1m15s
fix(security): replace string-prefix path containment with semantic is_relative_to — closes startswith bypass #7478 ( #11002 )
...
Replace str(path).startswith(str(root)) with Path.is_relative_to() in three
file-operation validation functions across the platform:
- file_ops.validate_sandbox_path() (was: string startswith check)
- inline_executor._validate_paths() (was: string startswith check)
- file_tools.validate_path() (added documentation reinforcing relative_to)
The vulnerability allowed sandbox prefix bypasses — e.g., a sandbox at
/tmp/sandbox would incorrectly accept /tmp/sandbox_evil/shell.py because
the target string happens to start with the root string. Path.is_relative_to()
uses semantic path containment comparison and correctly rejects such paths
regardless of naming coincidences.
Per docs/specification.md (line 46394): all path containment checks MUST use
Path.is_relative_to(root) or equivalent — never string prefix comparison.
ISSUES CLOSED : #7478
2026-05-08 08:04:29 +00:00
..
2026-05-07 20:05:33 +00:00
2026-04-15 06:37:18 +00:00
2026-04-27 07:33:18 +00:00
2026-04-30 10:56:21 +00:00
2026-05-08 08:04:29 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-28 03:22:06 +00:00
2026-04-23 11:46:36 +00:00
2026-05-01 09:10:48 +00:00
2026-04-05 21:26:33 +00:00
2026-05-07 20:05:33 +00:00
2026-04-13 04:56:01 +00:00
2026-05-07 20:05:33 +00:00
2026-04-17 16:28:45 +08:00
2026-04-05 21:19:40 +00:00
2026-04-13 04:56:01 +00:00
2026-05-06 01:07:15 +00:00
2026-04-27 05:00:54 +00:00
2026-05-05 01:33:31 +00:00
2026-04-17 16:28:45 +08:00
2026-04-30 10:56:21 +00:00
2026-04-23 16:15:49 +00:00
2026-04-13 04:56:01 +00:00
2026-04-23 12:19:50 +00:00
2026-04-30 10:56:21 +00:00
2026-05-06 04:08:25 +00:00
2026-04-30 02:05:12 +00:00
2026-04-27 05:00:54 +00:00
2026-05-03 00:17:15 +00:00
2026-05-07 20:05:33 +00:00
2026-05-02 21:54:17 +00:00
2026-05-05 02:01:49 +00:00
2026-04-28 05:00:12 +00:00
2026-04-23 09:08:11 +00:00
2026-05-07 07:08:52 +00:00
2026-04-30 02:05:12 +00:00
2026-04-20 13:54:28 +00:00
2026-04-13 04:56:01 +00:00
2026-05-03 00:39:15 +00:00
2026-04-17 18:33:39 +00:00
2026-04-17 11:46:38 +00:00
2026-04-13 04:56:01 +00:00
2026-05-05 02:01:49 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-05-05 02:01:49 +00:00
2026-04-08 11:02:14 +00:00
2026-04-13 04:56:01 +00:00
2026-05-05 02:01:49 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-30 10:56:21 +00:00
2026-05-05 02:01:49 +00:00
2026-05-07 20:05:33 +00:00
2026-04-21 05:14:07 +00:00
2026-05-05 11:05:07 +00:00
2026-05-07 20:05:33 +00:00
2026-04-17 11:46:38 +00:00
2026-04-27 07:33:18 +00:00
2026-04-17 11:46:38 +00:00
2026-04-23 12:19:50 +00:00
2026-04-12 08:15:49 +00:00
2026-04-08 11:02:14 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-09 13:00:47 +00:00
2026-04-15 00:24:13 +00:00
2026-04-12 16:43:30 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 02:01:49 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-30 10:56:21 +00:00
2026-04-21 16:53:08 +00:00
2026-05-08 05:11:47 +00:00
2026-04-24 05:45:20 +00:00
2026-05-05 17:18:16 +00:00
2026-05-07 23:49:20 +00:00
2026-04-20 06:08:50 +00:00
2026-05-07 20:05:33 +00:00
2026-05-07 20:05:33 +00:00
2026-04-13 04:56:01 +00:00
2026-04-24 22:46:41 +00:00
2026-05-02 01:36:45 +00:00
2026-04-30 14:56:33 +00:00
2026-05-05 05:25:28 +00:00
2026-04-09 14:17:50 +00:00
2026-04-28 04:06:57 +00:00
2026-04-28 04:06:57 +00:00
2026-04-17 22:49:46 +00:00
2026-05-05 02:01:49 +00:00
2026-04-26 11:19:10 +00:00
2026-04-23 09:22:33 +00:00
2026-04-13 04:56:01 +00:00
2026-04-19 17:10:17 +00:00
2026-04-13 04:56:01 +00:00
2026-04-24 10:32:15 +00:00
2026-04-21 03:38:05 +00:00
2026-04-17 08:34:33 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 02:01:49 +00:00
2026-04-13 04:56:01 +00:00
2026-04-17 08:34:33 +00:00
2026-05-05 02:01:49 +00:00
2026-04-17 08:34:33 +00:00
2026-04-17 08:34:33 +00:00
2026-04-13 04:56:01 +00:00
2026-04-21 11:31:15 +00:00
2026-05-07 20:05:33 +00:00
2026-04-30 14:56:33 +00:00
2026-05-07 20:05:33 +00:00
2026-05-05 02:01:49 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-05-05 02:01:49 +00:00
2026-04-09 06:11:39 +00:00
2026-05-05 17:18:16 +00:00
2026-04-10 18:59:10 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-05-07 20:05:33 +00:00
2026-04-13 04:56:01 +00:00
2026-05-05 06:16:46 +00:00
2026-05-05 06:16:46 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-05-07 20:05:33 +00:00
2026-04-30 10:03:08 +00:00
2026-05-03 00:17:15 +00:00
2026-04-21 11:56:19 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 02:01:49 +00:00
2026-05-05 10:56:18 +00:00
2026-04-08 11:02:14 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-05 21:11:53 +00:00
2026-04-13 04:56:01 +00:00
2026-04-23 12:19:50 +00:00
2026-05-08 06:24:23 +00:00
2026-04-17 18:00:47 +08:00
2026-04-14 02:51:16 +00:00
2026-04-21 01:59:07 +00:00
2026-04-08 11:02:14 +00:00
2026-04-08 11:02:14 +00:00
2026-04-30 02:05:12 +00:00
2026-04-25 04:21:23 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-08 11:02:14 +00:00
2026-05-07 23:39:08 +01:00
2026-04-13 04:56:01 +00:00
2026-04-15 13:37:16 +08:00
2026-04-28 09:23:33 +00:00
2026-04-13 04:56:01 +00:00
2026-04-08 11:02:14 +00:00
2026-04-13 04:56:01 +00:00
2026-04-21 06:42:10 +00:00
2026-04-28 10:12:06 +00:00
2026-05-05 04:04:13 +00:00
2026-04-26 18:23:48 +00:00
2026-04-26 12:19:34 +00:00
2026-05-05 09:37:22 +00:00
2026-05-02 21:57:54 +00:00
2026-04-13 04:56:01 +00:00
2026-04-27 02:06:23 +00:00
2026-04-24 11:05:02 +00:00
2026-04-24 19:01:56 +00:00
2026-05-05 17:48:39 +00:00
2026-04-13 04:56:01 +00:00
2026-04-08 11:02:14 +00:00
2026-04-13 04:56:01 +00:00
2026-04-08 11:02:14 +00:00
2026-04-08 11:02:14 +00:00
2026-04-08 11:02:14 +00:00
2026-05-07 14:22:57 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 21:16:55 +00:00
2026-04-26 17:34:52 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-05-07 19:14:53 +00:00
2026-04-08 11:02:14 +00:00
2026-04-08 11:02:14 +00:00
2026-04-27 01:12:35 +00:00
2026-04-13 04:56:01 +00:00
2026-04-23 18:29:11 +00:00
2026-04-22 00:45:09 +00:00
2026-05-08 08:04:29 +00:00
2026-04-13 04:56:01 +00:00
2026-04-10 20:50:20 +00:00
2026-04-13 04:56:01 +00:00
2026-04-28 07:33:43 +00:00
2026-04-27 07:33:18 +00:00
2026-04-27 07:33:18 +00:00
2026-04-24 04:11:54 +00:00
2026-04-13 04:56:01 +00:00
2026-04-21 08:45:06 +00:00
2026-04-06 07:55:09 +00:00
2026-04-13 04:56:01 +00:00
2026-04-30 15:36:26 +00:00
2026-04-24 03:01:13 +00:00
2026-04-23 23:01:46 +00:00
2026-04-22 14:06:42 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-13 04:56:01 +00:00
2026-04-22 06:37:17 +00:00
2026-04-06 07:55:09 +00:00
2026-04-30 10:56:21 +00:00