admin/Moltbot
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

test: make sandbox symlink-escape assertion platform-aware

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-16 06:06:42 +01:00
parent 7aa7b04fb0
commit 5212d1c79e
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/agents/sandbox/validate-sandbox-security.test.ts
View File

@@ -78,7 +78,15 @@ describe("validateBindMounts", () => {
const dir = mkdtempSync(join(tmpdir(), "openclaw-sbx-"));
const link = join(dir, "etc-link");
symlinkSync("/etc", link);
expect(() => validateBindMounts([`${link}/passwd:/mnt/passwd:ro`])).toThrow(/blocked path/);
const run = () => validateBindMounts([`${link}/passwd:/mnt/passwd:ro`]);
if (process.platform === "win32") {
// Windows source paths (e.g. C:\...) are intentionally rejected as non-POSIX.
expect(run).toThrow(/non-absolute source path/);
return;
}
expect(run).toThrow(/blocked path/);
});
it("rejects non-absolute source paths (relative or named volumes)", () => {