Skip to content

feat: backend security base — single-instance + op-lock, SSRF guard, atomic config, disk preflight #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Wangnov merged 4 commits into from
Jun 16, 2026
Merged

feat: backend security base — single-instance + op-lock, SSRF guard, atomic config, disk preflight #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
275debf
feat(backend): operation lock base + atomic-file/disk/paths utils [PR…
Wangnov Jun 16, 2026
1b7e708
feat(backend): atomic config writes, SSRF guard, macOS disk preflight…
Wangnov Jun 16, 2026
565d9e2
fix(oplock): hold long-lived lock fd to kill close-reopen race; clear…
Wangnov Jun 16, 2026
f67fd3d
fix(disk): gate test import on cfg(unix) to fix Windows unused-import…
Wangnov Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions crates/codex-mac-engine/src/download.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,10 @@ pub fn download_to_with_progress(
let mut child = Command::new("curl")
.args([
"-fL",
"--proto",
"=https",
"--proto-redir",
"=https",
"--no-progress-meter",
"-C",
"-",
Expand Down
15 changes: 14 additions & 1 deletion crates/codex-mac-engine/src/sys.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,16 @@ use crate::EngineError;
/// Fetch a small text resource (the appcast) over HTTPS via system `curl`.
pub fn fetch_text(url: &str) -> Result<String, EngineError> {
let output = Command::new("curl")
.args(["-fsSL", "--connect-timeout", "20", url])
.args([
"-fsSL",
"--proto",
"=https",
"--proto-redir",
"=https",
"--connect-timeout",
"20",
url,
])
.output()
.map_err(|e| EngineError::Io(format!("spawn curl: {e}")))?;

Expand All @@ -35,6 +44,10 @@ pub fn fetch_text_timeout(url: &str, max_secs: u64) -> Result<String, EngineErro
let output = Command::new("curl")
.args([
"-fsSL",
"--proto",
"=https",
"--proto-redir",
"=https",
"--connect-timeout",
"5",
"--max-time",
Expand Down
4 changes: 4 additions & 0 deletions crates/codex-win-engine/src/download.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,10 @@ fn run_curl(url: &str, dest: &Path, resume: bool, on_progress: &dyn Fn(u64)) ->
let dest = dest.to_string_lossy().into_owned();
let mut args = vec![
"-fL".to_string(),
"--proto".to_string(),
"=https".to_string(),
"--proto-redir".to_string(),
"=https".to_string(),
"--no-progress-meter".to_string(),
"--connect-timeout".to_string(),
"20".to_string(),
Expand Down
11 changes: 10 additions & 1 deletion crates/codex-win-engine/src/sys.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,16 @@ impl MsixDependencyPrecheck {

pub fn fetch_text(url: &str) -> Result<String, EngineError> {
let output = hidden_command("curl")
.args(["-fsSL", "--connect-timeout", "20", url])
.args([
"-fsSL",
"--proto",
"=https",
"--proto-redir",
"=https",
"--connect-timeout",
"20",
url,
])
.output()
.map_err(|e| EngineError::Io(format!("spawn curl: {e}")))?;

Expand Down
Loading