Skip to content

Restrict untrusted runner file RPC paths#5350

Open
huynhtrungcsc wants to merge 1 commit into
google:masterfrom
huynhtrungcsc:fix-untrusted-runner-file-paths
Open

Restrict untrusted runner file RPC paths#5350
huynhtrungcsc wants to merge 1 commit into
google:masterfrom
huynhtrungcsc:fix-untrusted-runner-file-paths

Conversation

@huynhtrungcsc

Copy link
Copy Markdown

Summary

  • Restrict untrusted runner file RPC operations to worker-owned filesystem roots.
  • Resolve paths before access so symlinks cannot escape the worker root.
  • Add regression coverage for outside-root access and symlink escape attempts.

Tests

  • PYTHONPATH=src python -m unittest src.clusterfuzz._internal.tests.core.bot.untrusted_runner.file_impl_test

@huynhtrungcsc huynhtrungcsc requested a review from a team as a code owner July 4, 2026 02:04
@huynhtrungcsc huynhtrungcsc force-pushed the fix-untrusted-runner-file-paths branch from b801346 to beb1c55 Compare July 4, 2026 03:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant