forked from EduCraft/curriculum-project-hub
29 lines
1.3 KiB
Markdown
29 lines
1.3 KiB
Markdown
# Close MCP context and file-delivery escape paths
|
|
|
|
Type: task
|
|
Status: resolved
|
|
|
|
## Question
|
|
|
|
Restrict file delivery to a realpath/no-follow target inside the current project
|
|
workspace, remove Git-root access, make inbound Hub writes symlink-safe, and
|
|
validate every Feishu message/thread result against the run's bound chat before
|
|
returning data to the model.
|
|
|
|
## Answer
|
|
|
|
All Agent-facing workspace file reads and writes are anchored to the configured
|
|
workspace root and current project. Linux uses descriptor-relative, no-follow
|
|
traversal so a symlink swap cannot escape after validation; unsupported unsafe
|
|
paths fail closed. Inbound Feishu files use the same boundary. Outbound file
|
|
delivery no longer accepts the repository Git root or arbitrary absolute
|
|
paths: it reads a no-follow snapshot from the current project and uploads that
|
|
snapshot, so the checked object cannot be swapped before delivery.
|
|
|
|
The Feishu MCP read surface carries the run's project and bound-chat context.
|
|
Message and thread results are rejected unless their returned chat matches that
|
|
binding, and file-delivery MCP calls remain scoped to the same run/project/chat
|
|
tuple. Unit and integration regressions cover symlink paths, sibling projects,
|
|
Git-root delivery attempts, swapped files, and cross-chat results; they are
|
|
included in the final 173-unit/85-integration green gate reported by Issue 16.
|