External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Enforce sandbox for update commands that may download packages (#220) (#229)

Browse Source 
ConfigureSandbox was only triggered by IsInstallationCommand(), missing
update commands (npm update, pnpm update, etc.) that pull new versions
and run postinstall scripts. Use MayDownloadPackages() as the sandbox
signal so all package-downloading commands are sandboxed.

Co-authored-by: Abhisek Datta <abhisek.datta@gmail.com>
This commit is contained in:
Sahil Bansal
2026-04-28 12:19:58 +00:00
committed by GitHub
co-authored by Abhisek Datta
parent 1a983c1dc1
commit 1d9045d770
4 changed files with 63 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/flows/common_flow.go
+1 -1
View File
@@ -34,7 +34,7 @@ func (f *commonFlow) Run(ctx context.Context, args []string, parsedCmd *packagem
var analyzers []analyzer.PackageVersionAnalyzer
// Configure sandbox based on command type and enforcement policy
config.ConfigureSandbox(parsedCmd.IsInstallationCommand())
config.ConfigureSandbox(parsedCmd.IsInstallationCommand() || parsedCmd.MayDownloadPackages())
cfg := config.Get()