External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Enforce sandbox for update commands that may download packages (#220) (#229)

Browse Source 
ConfigureSandbox was only triggered by IsInstallationCommand(), missing
update commands (npm update, pnpm update, etc.) that pull new versions
and run postinstall scripts. Use MayDownloadPackages() as the sandbox
signal so all package-downloading commands are sandboxed.

Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
This commit is contained in:
Sahil Bansal
2026-04-28 12:19:58 +00:00
committed by GitHub
co-authored by Abhisek Datta
parent 1a983c1dc1
commit 1d9045d770
4 changed files with 63 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/config.go
+3 -3
View File
@@ -379,11 +379,11 @@ func Get() *RuntimeConfig {
return globalConfig
}
func ConfigureSandbox(isInstallationCommand bool) {
func ConfigureSandbox(mayDownloadPackages bool) {
if globalConfig.Config.Sandbox.Enabled {
// Apply sandbox to all commands if EnforceAlways=true, otherwise only to
// installation commands else disable the sandbox
globalConfig.Config.Sandbox.Enabled = globalConfig.Config.Sandbox.EnforceAlways || isInstallationCommand
// commands that may download packages (install, update, etc.)
globalConfig.Config.Sandbox.Enabled = globalConfig.Config.Sandbox.EnforceAlways || mayDownloadPackages
}
}