Hard-deny unresolvable paths in write-path allowlist compare

Author: TheGreatAxios

src/permission/path-restriction.ts

@@ -44,7 +44,7 @@ function realpathOr(path: string): string {
 // simply missing. Contains a NUL byte, which can never appear in a real
 // filesystem path, so it can't collide with (or be mistaken for a prefix of)
 // any genuine result, and every containment compare against it fails.
-const UNRESOLVABLE = "\0unresolvable\0";
+export const UNRESOLVABLE = "\0unresolvable\0";
 
 // A write/edit target usually doesn't exist yet, so realpath the nearest
 // existing ancestor and rejoin the missing tail rather than falling back to

src/permission/workspace-containment.test.ts

@@ -108,14 +108,25 @@ test("a dangling symlink under cwd pointing outside denies a child path, and sta
   expect(restriction.isRestricted(target, false)).toBe(true);
   expect(restriction.isRestricted(target, true)).toBe(true);
 
-  // A race that creates the outside target between check and open must not
-  // retroactively legitimize the earlier check, and a fresh check afterward
-  // must still deny (the link still ultimately points outside the workspace).
+  // Creating the outside target after the initial check must not retroactively
+  // legitimize it: this is ordinary outside-symlink denial (the link still
+  // ultimately points outside the workspace), re-checked once the target exists.
   await mkdir(outsideTarget, { recursive: true });
   await writeFile(join(outsideTarget, "child.txt"), "s");
   expect(resolveWorkspacePath(cwd, join("dangling-link", "child.txt"), rootsProvider)).toBeUndefined();
 });
 
+test("a symlink loop under cwd is denied by resolveWorkspacePath (CL-6715)", async () => {
+  const rootsProvider = () => [];
+  const linkA = join(cwd, "loop-a");
+  const linkB = join(cwd, "loop-b");
+  await symlink(linkB, linkA);
+  await symlink(linkA, linkB);
+
+  expect(resolveWorkspacePath(cwd, join("loop-a", "child.txt"), rootsProvider)).toBeUndefined();
+  expect(resolveWorkspacePath(cwd, "loop-a", rootsProvider)).toBeUndefined();
+});
+
 test("resolveWorkspacePath returns the canonical target so a later symlink retarget cannot redirect a write (CL-6712 TOCTOU)", async () => {
   // A symlink that is in-bounds at check time (target -> inside cwd) must
   // resolve to the canonical real path, not the lexical path through the

src/permission/write-path-policy.test.ts

@@ -93,6 +93,26 @@ describe("matchesWritePathAllowlist with a symlinked cwd", () => {
   });
 });
 
+describe("matchesWritePathAllowlist with an unresolvable cwd", () => {
+  test("a cwd whose final component is a dangling symlink is hard-denied, not spuriously allowed (CL-6715)", () => {
+    // If cwd itself is unresolvable, both absCwd and abs collapse to the same
+    // UNRESOLVABLE sentinel, `abs === absCwd` goes true, rel becomes ".", and
+    // a root-matching pattern (e.g. "**") would otherwise spuriously allow —
+    // turning a hard authz deny into an ask-prompt.
+    const parent = mkdtempSync(join(realpathSync(tmpdir()), "write-path-dangling-parent-"));
+    const danglingCwd = join(parent, "dangling-cwd");
+    try {
+      symlinkSync(join(parent, "does-not-exist"), danglingCwd);
+
+      expect(matchesWritePathAllowlist("anything.md", ["**"], danglingCwd)).toBe(false);
+      expect(matchesWritePathAllowlist("PRODUCT.md", ["PRODUCT.md"], danglingCwd)).toBe(false);
+    } finally {
+      rmSync(danglingCwd, { force: true });
+      rmSync(parent, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("writePathDeniedReason", () => {
   test("names allowlist and subject", () => {
     const reason = writePathDeniedReason("src/x.ts", ["PRODUCT.md", "docs/*"]);

src/permission/write-path-policy.ts

@@ -1,6 +1,6 @@
 import { resolve, sep } from "node:path";
 import { matchesPattern } from "./matcher.js";
-import { realpathNearestOr } from "./path-restriction.js";
+import { realpathNearestOr, UNRESOLVABLE } from "./path-restriction.js";
 
 /**
  * Director write-path allowlist (authz, not prompt policy).
@@ -36,6 +36,11 @@ export function matchesWritePathAllowlist(
   // otherwise hard-deny a legitimate allowlisted write.
   const absCwd = realpathNearestOr(resolve(cwd));
   const abs = realpathNearestOr(resolve(cwd, subject));
+  // Either side unresolvable (dangling symlink/loop component) must hard-deny.
+  // Otherwise an unresolvable cwd and an unresolvable subject both collapse to
+  // the same sentinel, `abs === absCwd` goes true, rel becomes ".", and a
+  // root-matching allowlist pattern spuriously allows.
+  if (absCwd === UNRESOLVABLE || abs === UNRESOLVABLE) return false;
   let rel: string;
   if (abs === absCwd) {
     rel = ".";