Raised at install.sh:182 as medium by openai, ruled downgraded.
Claim. Checking only the staged file does not prevent a version-directory symlink from redirecting installation outside the versions folder.
Failure scenario. Pre-create versions/1.2.3 as a symlink to an unrelated writable directory that has no baley entry, then install version 1.2.3. The leaf checks all pass, mkdir -p accepts the symlinked directory, and mktemp and both moves operate in its external target. The installer writes an executable outside its intended staging tree and publishes a stable path dependent on that external directory.
Filed by Cadence. Fingerprint 5d460b82d951e01a over (file, claim).
Raised at install.sh:182 as medium by openai, ruled downgraded.
Claim. Checking only the staged file does not prevent a version-directory symlink from redirecting installation outside the versions folder.
Failure scenario. Pre-create versions/1.2.3 as a symlink to an unrelated writable directory that has no baley entry, then install version 1.2.3. The leaf checks all pass, mkdir -p accepts the symlinked directory, and mktemp and both moves operate in its external target. The installer writes an executable outside its intended staging tree and publishes a stable path dependent on that external directory.
Filed by Cadence. Fingerprint
5d460b82d951e01aover (file, claim).