External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: Sandbox policy tuning for tmp write access (#145)

Browse Source 
* fix: Sandbox policy tuning for tmp write access

* fix: Remove numbers from test

* Update sandbox/profiles/pnpm-restrictive.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* fix: Sandbox E2E test to consider Linux bubblewrap tmpfs mount

* Update sandbox/profiles/pnpm-restrictive.yml

Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>

* fix: Migrate deny rules from pnpm to npm policy

---------

Signed-off-by: Abhisek Datta <abhisek.datta@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Sahil Bansal <bansalsahil315@gmail.com>
This commit is contained in:
Abhisek Datta
2026-02-01 15:20:17 +05:30
committed by GitHub
co-authored by Copilot Sahil Bansal
parent b332e1d6d4
commit 4600ab0245
9 changed files with 354 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sandbox/util/dangerous_test.go
+33 -6
View File
@@ -22,19 +22,36 @@ func TestGetMandatoryDenyPatterns(t *testing.T) {
assert.Contains(t, patterns, "**/.docker/config.json")
})
t.Run("always blocks git hooks", func(t *testing.T) {
t.Run("always blocks git hooks in CWD and HOME", func(t *testing.T) {
cwd, err := os.Getwd()
assert.NoError(t, err)
home, err := os.UserHomeDir()
assert.NoError(t, err)
patterns := GetMandatoryDenyPatterns(false)
// Should block git hooks
assert.Contains(t, patterns, "**/.git/hooks")
assert.Contains(t, patterns, "**/.git/hooks/**")
// Should block git hooks in CWD
assert.Contains(t, patterns, filepath.Join(cwd, ".git/hooks"))
assert.Contains(t, patterns, filepath.Join(cwd, ".git/hooks/**"))
// Should block git hooks in HOME
assert.Contains(t, patterns, filepath.Join(home, ".git/hooks"))
assert.Contains(t, patterns, filepath.Join(home, ".git/hooks/**"))
})
t.Run("blocks git config when allowGitConfig is false", func(t *testing.T) {
cwd, err := os.Getwd()
assert.NoError(t, err)
home, err := os.UserHomeDir()
assert.NoError(t, err)
patterns := GetMandatoryDenyPatterns(false)
// Should block git config
assert.Contains(t, patterns, "**/.git/config")
// Should block git config in CWD and HOME
assert.Contains(t, patterns, filepath.Join(cwd, ".git/config"))
assert.Contains(t, patterns, filepath.Join(home, ".git/config"))
})
t.Run("allows git config when allowGitConfig is true", func(t *testing.T) {
@@ -76,4 +93,14 @@ func TestGetMandatoryDenyPatterns(t *testing.T) {
// Should include pattern for .env.* files
assert.Contains(t, patterns, "**/.env.*")
})
t.Run("does not use global globs for git operations", func(t *testing.T) {
patterns := GetMandatoryDenyPatterns(false)
// Should NOT contain global globs for git hooks/config
// This allows legitimate git operations in temp directories (e.g., npx cloning repos)
assert.NotContains(t, patterns, "**/.git/hooks")
assert.NotContains(t, patterns, "**/.git/hooks/**")
assert.NotContains(t, patterns, "**/.git/config")
})
}