1.3 KiB
Close MCP context and file-delivery escape paths
Type: task Status: resolved
Question
Restrict file delivery to a realpath/no-follow target inside the current project workspace, remove Git-root access, make inbound Hub writes symlink-safe, and validate every Feishu message/thread result against the run's bound chat before returning data to the model.
Answer
All Agent-facing workspace file reads and writes are anchored to the configured workspace root and current project. Linux uses descriptor-relative, no-follow traversal so a symlink swap cannot escape after validation; unsupported unsafe paths fail closed. Inbound Feishu files use the same boundary. Outbound file delivery no longer accepts the repository Git root or arbitrary absolute paths: it reads a no-follow snapshot from the current project and uploads that snapshot, so the checked object cannot be swapped before delivery.
The Feishu MCP read surface carries the run's project and bound-chat context. Message and thread results are rejected unless their returned chat matches that binding, and file-delivery MCP calls remain scoped to the same run/project/chat tuple. Unit and integration regressions cover symlink paths, sibling projects, Git-root delivery attempts, swapped files, and cross-chat results; they are included in the final 173-unit/85-integration green gate reported by Issue 16.