Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

[Bug] The desktop read / write / edit tools resolve their target lexically, so a symlink inside the workspace reaches outside it

Ouverte
  • Quelque chose ne va pas ?
#526 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
55/100
Type d'issue
Bug
Clarté
Clairement spécifiée
Activité
Active
Stack technique
typescript
Domaine
security

Piste de recherche

Start in packages/agent-tools/src/desktop/local-pi-tools.ts and trace resolveLocalCandidatePath through normalizeLocalExistingPath; compare how packages/agent-tools/src/desktop/path-guard.ts handles symlinks. Check the cloud counterpart at packages/agent-tools/src/cloud/matrix-tools/path-guard.ts too. Done means all three desktop tools reject targets whose resolved location is outside the workspace, including dangling links, while passing pi the original lexical absolute path.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Title

The desktop read / write / edit tools resolve their target lexically, so a symlink inside the workspace reaches outside it

Where

packages/agent-tools/src/desktop/local-pi-tools.ts

resolveLocalCandidatePath → normalizeLocalExistingPath resolves the
target against the workspace root and hands that spelling to pi, which opens
it as-is. The path guard that already knows about symlinks
(packages/agent-tools/src/desktop/path-guard.ts) is not called by these
three tools; it serves local-website-deploy.ts and the cloud
file-transfer.ts.

Reproduction

  1. In the workspace root, create link -> /outside/target.txt.
  2. Ask the agent to read link → the content of /outside/target.txt comes
    back.
  3. Ask it to write to link → /outside/target.txt changes.
  4. Ask it to edit link → /outside/target.txt changes.

A dangling symlink is the sharpest case: link -> /outside/new.txt, where
/outside/new.txt does not exist yet. Writing through it creates the file
outside the workspace.

The cloud path has the same blind spot in
packages/agent-tools/src/cloud/matrix-tools/path-guard.ts, where a dangling
link was treated as a missing file and compared lexically.

Impact

  • the agent reads and writes outside the workspace without any prompt
  • the permission layer compares paths lexically too, so these calls never
    reach the approval prompt
  • a dangling symlink lets a write create a file at an arbitrary path

Expected

The tool resolves the target through its real location — following symlinks,
and following dangling ones by hand — and refuses it when that location is
outside the workspace.

The fence should only validate. pi should still receive the lexical absolute
path, byte for byte, because the ledger key has to stay aligned with pi's own
resolveToCwd output. Changing the spelling would change the ledger key.

Notes and limits

  • the check and the open are two steps, so the link can be swapped in
    between. Closing that race needs a lower-level open.
  • bash is not covered here. It is arbitrary execution by design; a check
    there is advice, not a boundary.
  • a target that is already outside the workspace lexically keeps its current
    approval flow. Turning that approval into a hard failure would break
    cross-workspace reads users approve today, and that belongs to the
    permission layer rather than here.
Langage dominant
TypeScript
Étoiles
2k
Forks
259
Merge moyen
14 h 20 min
PR mergées (30 j)
56

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de MiniMax-AI/minimax-code

Toutes les issues de MiniMax-AI/minimax-code

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.