fix(sandbox): harden workspace_only host-FS allowlist - #87

Closed

adriannoes wants to merge 26 commits into

developmentfrom

cursor/sandbox-fs-allowlist-d519

Commits on Sep 14, 2026

test(sandbox): reject .. escapes for nonexistent shell destinations
adriannoes
committed
dc2883c
fix(sandbox): walk existing ancestor before workspace prefix check
adriannoes
committed
ba1002d
test(sandbox): reject quoted and embedded absolute shell paths
adriannoes
committed
a482524
fix(sandbox): scan quoted and embedded absolute paths in allowlist
adriannoes
committed
198330b
test(sandbox): reject $HOME and $PWD expansions in workspace allowlist
adriannoes
committed
8f90fec
fix(sandbox): expand $HOME and $PWD before workspace allowlist checks
adriannoes
committed
d9d1a9a
test(sandbox): reject glued $IFS and mid-token $HOME expansions
adriannoes
committed
6f4b3b5
fix(sandbox): scan $ expansions on the full shell command
adriannoes
committed
79bc0c6
docs(sandbox): record workspace_only glued-$ gate and residuals
adriannoes
committed
590247e
test(sandbox): reject missing-dir .., file: URLs, and embedded ../
adriannoes
committed
7126bd9
fix(sandbox): collapse .. lexically and scan file: plus embedded ../
adriannoes
committed
9bdec30
fix(sandbox): zero-init lexical collapse segment pointers
adriannoes
committed
76ccc1b
test(sandbox): reject encoded slash, HOME/PWD assign, symlink .., file %
adriannoes
committed
16a643c
fix(sandbox): block encoded slash, HOME/PWD assign, symlink .., file %
adriannoes
committed
a39c6a4
fix(sandbox): narrow encoded-slash octal locals for cppcheck
adriannoes
committed
264a059
test(sandbox): reject quoted HOME/PWD assign, split file:, encoded dot
adriannoes
committed
c6798b3
fix(sandbox): catch quoted HOME/PWD, split file:, encoded dot/N
adriannoes
committed
185d165
fix(sandbox): narrow encoded-dot hex local for cppcheck
adriannoes
committed
925a0dc
test(sandbox): reject URL ../, Perl \\x{}, env -i/pop, comma HOME=
adriannoes
committed
d568e1c
fix(sandbox): catch URL ../, Perl \x{}, env -i/pop, comma HOME=
adriannoes
committed
65e375d
test(sandbox): reject read/unset env, Perl \o{}, encoded file:
adriannoes
committed
0dfeecf
fix(sandbox): catch read/--unset/-iu, Perl \o{}, encoded file:
adriannoes
committed
beae45a
test(sandbox): reject octal/identity file:, \\+nl, printf -v
adriannoes
committed
311d70e
fix(sandbox): catch octal/identity file:, \\+nl, printf -v
adriannoes
committed
2d0fc3e
test(sandbox): reject identity HOME/PWD, nameref, encoded $
adriannoes
committed
971d64f
fix(sandbox): fold identity before HOME/PWD; decode encoded $
adriannoes
committed
3f6528f

Navigation Menu

fix(sandbox): harden workspace_only host-FS allowlist - #87

fix(sandbox): harden workspace_only host-FS allowlist#87
adriannoes wants to merge 26 commits into
developmentfrom
cursor/sandbox-fs-allowlist-d519

Commits on Sep 14, 2026

test(sandbox): reject .. escapes for nonexistent shell destinations

fix(sandbox): walk existing ancestor before workspace prefix check

test(sandbox): reject quoted and embedded absolute shell paths

fix(sandbox): scan quoted and embedded absolute paths in allowlist

test(sandbox): reject $HOME and $PWD expansions in workspace allowlist

fix(sandbox): expand $HOME and $PWD before workspace allowlist checks

test(sandbox): reject glued $IFS and mid-token $HOME expansions

fix(sandbox): scan $ expansions on the full shell command

docs(sandbox): record workspace_only glued-$ gate and residuals

test(sandbox): reject missing-dir .., file: URLs, and embedded ../

fix(sandbox): collapse .. lexically and scan file: plus embedded ../

fix(sandbox): zero-init lexical collapse segment pointers

test(sandbox): reject encoded slash, HOME/PWD assign, symlink .., file %

fix(sandbox): block encoded slash, HOME/PWD assign, symlink .., file %

fix(sandbox): narrow encoded-slash octal locals for cppcheck

test(sandbox): reject quoted HOME/PWD assign, split file:, encoded dot

fix(sandbox): catch quoted HOME/PWD, split file:, encoded dot/N

fix(sandbox): narrow encoded-dot hex local for cppcheck

test(sandbox): reject URL ../, Perl \\x{}, env -i/pop, comma HOME=

fix(sandbox): catch URL ../, Perl \x{}, env -i/pop, comma HOME=

test(sandbox): reject read/unset env, Perl \o{}, encoded file:

fix(sandbox): catch read/--unset/-iu, Perl \o{}, encoded file:

test(sandbox): reject octal/identity file:, \\+nl, printf -v

fix(sandbox): catch octal/identity file:, \\+nl, printf -v

test(sandbox): reject identity HOME/PWD, nameref, encoded $

fix(sandbox): fold identity before HOME/PWD; decode encoded $