mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
349ee1f905
The file-explorer overlap check canonicalized declared bind sources (it realpaths the source) but compared them against the Sencho-managed paths (compose base, data dir, application root, OS temp root, upload spool, Trivy binary, Trivy cache) using path.resolve only. A managed path that is itself a symlink, for example a relocated Trivy binary whose configured path links to a real binary elsewhere, was therefore compared by its symlink path. A bind to the symlink target's real directory did not register as a managed overlap and became browsable and writable, so a stack editor could overwrite the real binary a later pre or post deploy scan executes, or reach transient registry credentials under a symlinked temporary root. Resolve each managed path to its canonical target and keep both the configured path and the realpath target in the overlap set, mirroring the bind-side canonicalization. Containment only ever expands, so existing deployments and fresh installs are unaffected. A missing managed path (the common fresh-install case) is tolerated: the configured path still anchors containment, and any non-ENOENT realpath failure is logged rather than collapsing discovery. Adds two tests: a regression test that fails when a symlinked managed Trivy path is compared without canonicalization, and a fresh-install test that an absent managed path leaves a legitimate external bind browsable.