From 1942ed3a104ec85dc5e6b17a676eb30030b8e0a7 Mon Sep 17 00:00:00 2001 From: Simon Sawert Date: Sun, 13 Sep 2026 21:31:04 +0200 Subject: [PATCH] fix: sandbox os.stat, os.mkdir, and os.rmdir to staged root App code calling os.stat on absolute paths hit the real host filesystem instead of the staged checkout, so file sizes read as missing (0b) and os.mkdir/os.rmdir could touch real host paths. --- matrixbox_simulator/device/run_app.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/matrixbox_simulator/device/run_app.py b/matrixbox_simulator/device/run_app.py index e8eb36f..b57346b 100644 --- a/matrixbox_simulator/device/run_app.py +++ b/matrixbox_simulator/device/run_app.py @@ -129,6 +129,9 @@ def _install_path_sandbox(root: Path) -> None: real_listdir = os.listdir real_remove = os.remove real_chdir = os.chdir + real_stat = os.stat + real_mkdir = os.mkdir + real_rmdir = os.rmdir def resolve(path: Any) -> Any: # Idempotent: a path already inside root (e.g. a real filesystem @@ -158,11 +161,23 @@ def sandboxed_remove(path: Any, *args: Any, **kwargs: Any) -> None: def sandboxed_chdir(path: Any) -> None: return real_chdir(resolve(path)) + def sandboxed_stat(path: Any, *args: Any, **kwargs: Any) -> object: + return real_stat(resolve(path), *args, **kwargs) + + def sandboxed_mkdir(path: Any, *args: Any, **kwargs: Any) -> None: + return real_mkdir(resolve(path), *args, **kwargs) + + def sandboxed_rmdir(path: Any, *args: Any, **kwargs: Any) -> None: + return real_rmdir(resolve(path), *args, **kwargs) + builtins.open = sandboxed_open # ty: ignore[invalid-assignment] os.rename = sandboxed_rename # ty: ignore[invalid-assignment] os.listdir = sandboxed_listdir # ty: ignore[invalid-assignment] os.remove = sandboxed_remove # ty: ignore[invalid-assignment] os.chdir = sandboxed_chdir # ty: ignore[invalid-assignment] + os.stat = sandboxed_stat # ty: ignore[invalid-assignment] + os.mkdir = sandboxed_mkdir # ty: ignore[invalid-assignment] + os.rmdir = sandboxed_rmdir # ty: ignore[invalid-assignment] class _BytesLiteralWrapper(ast.NodeTransformer):