Request: resolve case and Unicode folding when matching sandbox/settings-file paths

Aperta
  • Qualcosa non va?
#685 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
38/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
macos, typescript
Ambito
security

Direzione di ricerca

Start by locating the preflight glob for .claude/settings*.json and the sandbox denyWrite path-matching logic; the issue does not name source files or tests. Check how those paths are resolved on macOS, then determine whether the acceptance cases are refused; if the fix is deferred, the stated alternative is to document the case-sensitivity limit in the sandbox/denyWrite docs.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem. A per-agent sandbox preflight (a glob over .claude/settings*.json) and, suspected but unconfirmed, Claude Code's own sandbox.filesystem.denyWrite policy both appear to compare paths as literal strings. macOS's APFS file system is case-insensitive and Unicode-folding, and Claude's own file-open for settings.json/settings.local.json resolves through that folding. A differently-cased or Unicode-confusable spelling (Settings.Local.JSON, ſettings.json with U+017F long s, or a broken case-variant symlink) is invisible to a literal glob/string check but still resolves to the real settings file when Claude opens it — letting a sandboxed temp (reachable via --add-dir) plant a plugin-enabling config undetected.

Proposed fix. For any path-matching Claude Code does for sandbox denial or settings-file discovery under a --add-dir folder, resolve the path (stat/realpath) rather than literally string/glob-comparing it, so every spelling that the file system folds to the canonical name is caught. If not fixed immediately, document the case-sensitivity limit explicitly in the sandbox/denyWrite docs.

Acceptance. A write to Settings.Local.JSON, a long-s variant, or a case-variant broken symlink targeting .claude/settings.json/settings.local.json inside a sandboxed --add-dir folder is refused identically to the canonical spelling.

Supporting diagnosis (three concrete bypass spellings demonstrated, plus the pre-fix glob allowing one real write through) and exact internal evidence are available on request.

Lingua principale
TypeScript
Stelle
8.5k
Fork
1.2k
Merge medio
12h 50m
PR unite (30g)
63

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di HarnessMD/munder-difflin

Tutte le issue di HarnessMD/munder-difflin

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.