Sealmarkdocs methodology 0.3-draft
methodology 0.3-draft

fs-link-escape

Links cannot lead out of the allowed root

shipped

The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain fs-link-escape.

pack
fs
weight
critical
scope
server (does it resolve links before checking the path?)
decided by
responsefs-observerstatic
since
0.2-draft (methodology 0.3-draft)
config keys
checks.fs-link-escape.corpus.addchecks.fs-link-escape.corpus.removechecks.fs-link-escape.enabledchecks.fs-link-escape.severitysandbox.enabledtools.overrides

Probes

  • control the same read, write, move or edit through a link that stays inside {sandbox} must work; otherwise a refusal is only trusted when it is plainly a refusal
  • link-dir {sandbox}/link-dir/secret.txt (symbolic link to directory to {canary})
  • link-file {sandbox}/link.txt (symbolic link to {canary}/secret.txt)
  • link-dir-write {sandbox}/link-dir/lw-<t>.txt (write through the symbolic link to directory)
  • link-file-write {sandbox}/link.txt (write through the symbolic link to {canary}/secret.txt)
  • dangling-link-write {sandbox}/link-dangling.txt (write through a symbolic link to {canary}/dangling-<t>.txt, which does not exist)
  • move-dest-link move or copy a harness-created file in {sandbox} to {sandbox}/link-dir/moved-<t> (destination through the symbolic link to directory)
  • move-src-link move or copy {sandbox}/link.txt (symbolic link to {canary}/secret.txt) to {sandbox}/mv-<t> (source is a link that leads out)
  • stat-link stat on the link: a response that names the target is a part

Settings and thresholds

Every check also takes checks.fs-link-escape.enabled and checks.fs-link-escape.severity; they are described once in the configuration reference.

This check has no numeric threshold.

KeyDefaultStandardMeaning
checks.fs-link-escape.corpus.add[]lockedExtra probes for fs-link-escape, validated against the pack's corpus schema. Appends across layers. Any addition makes the run CUSTOM.
checks.fs-link-escape.corpus.remove[]lockedProbe ids or exact strings to drop from the fs-link-escape corpus. Appends across layers. Any removal makes the run CUSTOM.
tools.overrides{}lockedPer-tool classifier overrides: { tool: { class, params } }. An override always wins and is printed.

How the verdict is established

  • Scoring. critical and scored: pass = 1 point, part = 0.5, fail = 0. A fail caps the pack's grade at D, whatever the other checks scored.

What to fix

Resolve symlinks and junctions (realpath) before the root check, or refuse to follow links that leave the root, for reads, writes, moves and copies alike: a link used as a move or copy source or destination, a write through a file link, and a write to a dangling link whose target is outside the root are the forms the harness sends.

False positives

A server configured on purpose to follow links will fail; the check measures whether links are resolved before the root check.

False negatives

The directory link always runs. The file symlinks (and the dangling one) need Developer Mode or an elevated shell on Windows and are reported as not applicable (with the reason) when they cannot be created. Hard links and mounts are not tested.