From f9ca2268e54f8c32d3d4576eb6d751a12646d279 Mon Sep 17 00:00:00 2001 From: Khaliq Date: Sun, 23 Aug 2026 23:35:01 +0200 Subject: [PATCH] fix(mount): align late-bound path validation --- src/mount-script.test.ts | 8 ++++++++ src/mount-script.ts | 2 ++ 2 files changed, 10 insertions(+) diff --git a/src/mount-script.test.ts b/src/mount-script.test.ts index 1749cad..88b57b6 100644 --- a/src/mount-script.test.ts +++ b/src/mount-script.test.ts @@ -353,6 +353,14 @@ describe("exact local-layout contract", () => { pathArgs: " --remote-path '/github/../secrets'", message: /relayfile remote root contains a traversal segment/, }, + { + pathArgs: " --remote-path 'github/repos/acme/cloud'", + message: /relayfile remote root must be absolute/, + }, + { + pathArgs: " --remote-path '/'", + message: /relayfile remote root must not be empty/, + }, ]) { let shell = template.startShellTemplate; for (const [key, value] of Object.entries(values)) { diff --git a/src/mount-script.ts b/src/mount-script.ts index 0f2fb7c..2a1124f 100644 --- a/src/mount-script.ts +++ b/src/mount-script.ts @@ -785,9 +785,11 @@ function dynamicMountPreflight(pathArgsPlaceholderArg: string): string[] { 'while [ "$#" -gt 0 ]; do', 'if [ "$#" -lt 2 ] || [ "$1" != "--remote-path" ]; then echo "invalid relayfile mount path args" >&2; exit 2; fi;', 'relayfile_mount_remote_path="$2";', + 'case "$relayfile_mount_remote_path" in /*) ;; *) echo "relayfile remote root must be absolute" >&2; exit 2 ;; esac;', 'case "/${relayfile_mount_remote_path#/}/" in */../*|*/./*) echo "relayfile remote root contains a traversal segment" >&2; exit 2 ;; esac;', 'relayfile_mount_remote_suffix="${relayfile_mount_remote_path#/}";', 'relayfile_mount_remote_suffix="${relayfile_mount_remote_suffix%/}";', + 'if [ -z "$relayfile_mount_remote_suffix" ]; then echo "relayfile remote root must not be empty" >&2; exit 2; fi;', 'case "$relayfile_mount_preflight_root" in', '"$relayfile_mount_remote_suffix") relayfile_mount_preflight_root=/ ;;', '*/"$relayfile_mount_remote_suffix") relayfile_mount_preflight_root="${relayfile_mount_preflight_root%"/$relayfile_mount_remote_suffix"}"; [ -n "$relayfile_mount_preflight_root" ] || relayfile_mount_preflight_root=/ ;;',