[front] Fix sandbox function staging reads against symlink swap (TOCTOU) - #30191
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
![dust-agent[bot]](https://avatars.githubusercontent.com/in/1117438?s=60&v=4){kind=small}
zmarouf
approved these changes
Aug 7, 2026
zmarouf
left a comment
zmarouf
left a comment
Contributor
There was a problem hiding this comment.
LGTM. I tried poking and the only thing I found was the sha256sum format that GNU based.
But the check fails closed.
buildSandboxFunctionOnSandbox and getDatabaseSchemaOnSandbox stage artifacts in agent-writable /tmp dirs as agent-proxied, then read them back through the provider file API, which envd serves as root while following symlinks. Code running as the agent on the same sandbox VM could swap a staging file for a symlink to a root-only file (e.g. /run/dust/egress-secrets.json) between the exec and the read, and the root read would return that file's content to the caller or persist it as a published function bundle. Pin each artifact to the sha256 captured at the end of the producing exec and fail closed on mismatch. A swap before the capture fails the capture itself (set -e: sha256sum cannot open the swapped target as agent-proxied); a swap after the capture no longer hashes equal. Error messages never carry content, so a swapped-in file cannot leak through the error path either.
…sing hash Review feedback: anchor the stdout split on the last full-line marker so a model printing the marker string cannot shadow the real capture or truncate its own output mid-stream, and include the exec stderr in the missing-hash error so a failed capture (e.g. sha256sum denied on a swapped target) is debuggable.
fontanierh
force-pushed
the
staging-integrity
branch
from
August 10, 2026 12:36
6431ecd to
4488572
Compare
Splitting every dsbx db command's stdout at the capture marker let code the command imports (the model-written schema file during reconcile) print a forged envelope followed by a marker line and shadow the real envelope, which is otherwise always the last stdout line. Gate the split on an explicit stagingCapture flag that only db schema sets.
Fixes the format-check failure (biome requires type imports separated from value imports).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
buildSandboxFunctionOnSandboxandgetDatabaseSchemaOnSandboxstage artifacts in agent-writable/tmpdirs asagent-proxied, then read them back through the provider file API, which envd serves as root while following symlinks. Code running as the agent on the same sandbox VM could swap a staging file for a symlink to a root-only file (e.g./run/dust/egress-secrets.json) between the exec and the read, and the root read would return that file's content to the caller or persist it as a published function bundle.Each producing exec now appends a marker and per-file sha256 lines after the dsbx output, and the read-back content is verified against those hashes before use, failing closed on any mismatch:
set -e;sha256sumcannot open the swapped target asagent-proxied)Follow-ups not in this PR: same hardening for any future
provider.readFile/writeFilecaller under agent-writable paths, and the dsbx port-80 Host pinning issue tracked separately.Tests
staging_integrity.test.tsfor the split/verify helpers.build_on_sandbox.test.tsand a newdsbx_db.test.tscovering the schema flow (match, swapped file, missing hash).lib/api/sandbox_functionsandlib/api/sandboxsuites pass locally in a dust-hive env (70 + 363 tests).Risk
Low. Only the two staging flows change; both fail closed on any anomaly (missing marker, missing hash, mismatch), so worst case is a failed publish/schema read that the model can retry. Rollback is a revert.
Deploy Plan
Standard deploy.