feat(worker): home-scoped box file tree/read/write with realpath containment

2026-07-11 12:05:04 -04:00
parent 6439e5200b
commit bf0276b1f3
3 changed files with 196 additions and 2 deletions
@@ -21,13 +21,15 @@ const realpathOrDeepestExisting = async (target: string): Promise<string> => {
 export const assertContainedRealPath = async (
  root: string,
  requested: string,
-  opts: { forWrite?: boolean } = {},
+  opts: { forWrite?: boolean; label?: string } = {},
 ): Promise<string> => {
  const lexical = path.resolve(root, requested);
  const realRoot = await realpath(root);
  const resolved = await realpathOrDeepestExisting(lexical);
  if (resolved !== realRoot && !resolved.startsWith(`${realRoot}${path.sep}`)) {
-    throw new Error(`Refusing to access path outside root: ${requested}`);
+    throw new Error(
+      `Refusing to access path outside ${opts.label ?? 'root'}: ${requested}`,
+    );
  }
  if (opts.forWrite) {
    const info = await lstat(lexical).catch(() => null);