MediaMetz/gemini-cli
1
0
Fork 0
mirror of https://github.com/google-gemini/gemini-cli.git synced 2026-04-22 02:54:31 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix(core): ensure global temp directory is always in sandbox allowed paths (#24638)

Browse Source 
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
This commit is contained in:
Gal Zahavi
2026-04-03 17:23:27 -07:00
committed by GitHub
parent 4fb3790051
commit 65024d4538
9 changed files with 91 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/services/sandboxedFileSystemService.ts
+22 -5
View File
@@ -22,12 +22,29 @@ export class SandboxedFileSystemService implements FileSystemService {
private sanitizeAndValidatePath(filePath: string): string {
const resolvedPath = resolveToRealPath(filePath);
if (!isSubpath(this.cwd, resolvedPath) && this.cwd !== resolvedPath) {
throw new Error(
`Access denied: Path '${filePath}' is outside the workspace.`,
);
const workspace = resolveToRealPath(this.sandboxManager.getWorkspace());
if (isSubpath(workspace, resolvedPath) || workspace === resolvedPath) {
return resolvedPath;
}
return resolvedPath;
// Check if the path is explicitly allowed by the sandbox manager
const options = this.sandboxManager.getOptions();
const allowedPaths = options?.includeDirectories ?? [];
for (const allowed of allowedPaths) {
const resolvedAllowed = resolveToRealPath(allowed);
if (
isSubpath(resolvedAllowed, resolvedPath) ||
resolvedAllowed === resolvedPath
) {
return resolvedPath;
}
}
throw new Error(
`Access denied: Path '${filePath}' is outside the workspace and not in allowed paths.`,
);
}
async readTextFile(filePath: string): Promise<string> {