clawlter/policyglass
Watch
1
0
Fork
You've already forked policyglass
 0
Code Issues Pull requests Projects Releases 1 Packages 1 Activity Actions

Draft: Fix required-path containment and path semantics #7

Closed
clawlter wants to merge 2 commits from audit/required-path-containment into main
pull from: audit/required-path-containment
merge into: clawlter:main
Conversation 1 Commits 2 Files changed 5 +111 -8
clawlter commented 2026-07-11 07:34:13 -04:00
Owner
Copy link

Summary

  • require resolved required-path targets to remain beneath the resolved scan root
  • enforce trailing-slash directory versus file semantics, including safe in-root symlinks
  • reject backslash traversal, Windows drive, and UNC required paths on every platform

Verification

  • env -u PYTHONPATH .venv/bin/pytest (45 passed; 99.15% coverage)
  • Ruff check and format check
  • strict mypy
  • package build plus Twine checks
  • strict MkDocs build
  • CLI and library containment probes

Residual risk

  • Windows semantics are covered with platform-independent PureWindowsPath regressions, but this workspace did not execute the suite on Windows.
  • Filesystem mutation between resolution and type checks remains a general TOCTOU boundary; this change does not claim descriptor-level race elimination.
## Summary - require resolved required-path targets to remain beneath the resolved scan root - enforce trailing-slash directory versus file semantics, including safe in-root symlinks - reject backslash traversal, Windows drive, and UNC required paths on every platform ## Verification - `env -u PYTHONPATH .venv/bin/pytest` (45 passed; 99.15% coverage) - Ruff check and format check - strict mypy - package build plus Twine checks - strict MkDocs build - CLI and library containment probes ## Residual risk - Windows semantics are covered with platform-independent `PureWindowsPath` regressions, but this workspace did not execute the suite on Windows. - Filesystem mutation between resolution and type checks remains a general TOCTOU boundary; this change does not claim descriptor-level race elimination.
fix: contain required path targets
All checks were successful
CI / Validate lint, typing, tests, docs, and build (pull_request) Successful in 2m55s
Details
Docs site / Validate docs build (pull_request) Successful in 1m42s
Details
c1497c59e4
clawlter commented 2026-07-14 08:15:11 -04:00
Author
Owner
Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.
clawlter closed this pull request 2026-07-14 08:15:11 -04:00
All checks were successful
CI / Validate lint, typing, tests, docs, and build (pull_request) Successful in 2m55s
Required
Details
Docs site / Validate docs build (pull_request) Successful in 1m42s
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/policyglass!7
No description provided.