lukaszraczylo 8d940022b7 fix(search): drop matches outside the workspace root (symlink escape) ...

file_search runs ripgrep with --follow on by default, so a symlink inside the
workspace pointing outside it (e.g. link -> /etc) caused rg to traverse out and
return matches from external files — leaking their content to the caller despite
the workspace-scoping contract. parseOutput emitted match paths verbatim with no
re-validation.

Filter every match through IsPathAllowed (resolving rg's workspace-relative path
against the root first); IsPathAllowed's EvalSymlinks rejects the escape while
still permitting legitimate worktree siblings. Defense in depth that also covers
--no-ignore and any other traversal that reaches outside the root.

Adds a security regression test (proven to fail without the filter).

2026-06-21 01:59:53 +01:00

..

format_test.go

V2/token optimization (#11)

2026-04-19 19:56:49 +01:00

search_test.go

fix(search): drop matches outside the workspace root (symlink escape)

2026-06-21 01:59:53 +01:00

search.go

fix(search): drop matches outside the workspace root (symlink escape)

2026-06-21 01:59:53 +01:00