Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

[Bug] The desktop read / write / edit tools resolve their target lexically, so a symlink inside the workspace reaches outside it

未关闭
  • 哪里不对？
#526 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
55/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
typescript
领域
security

调研方向

Start in packages/agent-tools/src/desktop/local-pi-tools.ts and trace resolveLocalCandidatePath through normalizeLocalExistingPath; compare how packages/agent-tools/src/desktop/path-guard.ts handles symlinks. Check the cloud counterpart at packages/agent-tools/src/cloud/matrix-tools/path-guard.ts too. Done means all three desktop tools reject targets whose resolved location is outside the workspace, including dangling links, while passing pi the original lexical absolute path.

由索引模型根据 Issue 内容生成。

描述

Title

The desktop read / write / edit tools resolve their target lexically, so a symlink inside the workspace reaches outside it

Where

packages/agent-tools/src/desktop/local-pi-tools.ts

resolveLocalCandidatePath → normalizeLocalExistingPath resolves the
target against the workspace root and hands that spelling to pi, which opens
it as-is. The path guard that already knows about symlinks
(packages/agent-tools/src/desktop/path-guard.ts) is not called by these
three tools; it serves local-website-deploy.ts and the cloud
file-transfer.ts.

Reproduction

  1. In the workspace root, create link -> /outside/target.txt.
  2. Ask the agent to read link → the content of /outside/target.txt comes
    back.
  3. Ask it to write to link → /outside/target.txt changes.
  4. Ask it to edit link → /outside/target.txt changes.

A dangling symlink is the sharpest case: link -> /outside/new.txt, where
/outside/new.txt does not exist yet. Writing through it creates the file
outside the workspace.

The cloud path has the same blind spot in
packages/agent-tools/src/cloud/matrix-tools/path-guard.ts, where a dangling
link was treated as a missing file and compared lexically.

Impact

  • the agent reads and writes outside the workspace without any prompt
  • the permission layer compares paths lexically too, so these calls never
    reach the approval prompt
  • a dangling symlink lets a write create a file at an arbitrary path

Expected

The tool resolves the target through its real location — following symlinks,
and following dangling ones by hand — and refuses it when that location is
outside the workspace.

The fence should only validate. pi should still receive the lexical absolute
path, byte for byte, because the ledger key has to stay aligned with pi's own
resolveToCwd output. Changing the spelling would change the ledger key.

Notes and limits

  • the check and the open are two steps, so the link can be swapped in
    between. Closing that race needs a lower-level open.
  • bash is not covered here. It is arbitrary execution by design; a check
    there is advice, not a boundary.
  • a target that is already outside the workspace lexically keeps its current
    approval flow. Turning that approval into a hard failure would break
    cross-workspace reads users approve today, and that belongs to the
    permission layer rather than here.
主要语言
TypeScript
星标
2k
派生
259
平均合并
9 小时 58 分钟
30 天内合并 PR
54

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

MiniMax-AI/minimax-code 的其他 Issue

查看 MiniMax-AI/minimax-code 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。