Denials: the observed want names the denied path, not the backtrace frame - #86
Merged
Merged
Conversation
…rame Runtime errno crashes (ruby/node/python) lead with the source frame and trail with the denied path; taking the first absolute path in the line attributed the want to the code that tripped over the boundary. Caught live at the plans#36 ceremony: dev install-deps crashed with EACCES on /Users/Shared/dev/engines/ue5-mac/current, and the want rendered the dev-core Cellar frame path with the Brewfile menu — dodging the category-4/5 'covered by design' classifier the real path matches. Take the last path match instead: errno shapes trail with the denied path and single-path shell denials are unaffected. Co-authored-by: Cursor <cursoragent@cursor.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Caught live at the plans#36 ceremony smoke run (cellbound-3d run):
dev install-depscrashed with EACCES on/Users/Shared/dev/engines/ue5-mac/current, but the observed want rendered/opt/homebrew/Cellar/dev-core/.../gh_integration.rb— the ruby backtrace frame, becauseTOUCHED_PATHtook the first absolute path in the line. Knock-on: the real denied path is under/Users/Shared/devand should have classified as covered by design (categories 4–5); the frame path instead got the Brewfile/dependencies.rb menu, which is nonsense for dev-core's own Cellar.Fix: take the last path match per denial line. Errno shapes (ruby
Permission denied @ ... - /path (Errno::EACCES), nodeEACCES ... open '/path', python[Errno 13] ...: '/path') all trail with the denied path; single-path shell denials (rm: /path: Permission denied) are unaffected. Test-first: the new case failed on the frame path before the fix.Full suite + srb tc green.
Made with Cursor