Raised at spikes/host-matrix/live-claude-restore.sh:132 as high by openai, ruled downgraded.
Claim. The restore script does not validate path containment, so this deletion can remove an existing database outside the disposable root.
Failure scenario. After setup and post-run reads, make ROOT/results a symlink to an external directory containing the saved reads.txt and pins.txt and a valuable baley-copy.db. All existence checks pass because they follow symlinks. COPY resolves into that external directory, so this command deletes its database and the following backup replaces it. The scratch creation and cleanup also operate outside ROOT. Unlike setup, restore never rejects linked path components; its final cp likewise follows a symlinked baley.db destination.
Filed by Cadence. Fingerprint 24ee35c64a8770ba over (file, claim).
Raised at spikes/host-matrix/live-claude-restore.sh:132 as high by openai, ruled downgraded.
Claim. The restore script does not validate path containment, so this deletion can remove an existing database outside the disposable root.
Failure scenario. After setup and post-run reads, make ROOT/results a symlink to an external directory containing the saved reads.txt and pins.txt and a valuable baley-copy.db. All existence checks pass because they follow symlinks. COPY resolves into that external directory, so this command deletes its database and the following backup replaces it. The scratch creation and cleanup also operate outside ROOT. Unlike setup, restore never rejects linked path components; its final cp likewise follows a symlinked baley.db destination.
Filed by Cadence. Fingerprint
24ee35c64a8770baover (file, claim).