mirror of
https://github.com/usestrix/strix.git
synced 2026-11-05 07:37:19 +00:00
659f643b9d
Two Greptile findings on #791: - P1 security: batch_view_files prefixed `workspace/` but didn't guard `..`, so `workspace/../../etc/passwd` was cat'd verbatim as `/workspace/../../etc/passwd` and read container files outside the target. Added `_safe_workspace_path()`: normalizes the path and rejects anything that resolves outside `/workspace` (per-item error, never handed to cat); the safe entries in the batch still read. - P1: a full valid batch could exceed the enclosing @function_tool deadline and be cancelled before returning isolated results. Worst case is ceil(_MAX_ITEMS/_MAX_CONCURRENCY)=7 waves of the per-item timeout; the old 60s per item => ~420s > the 180s/300s tool deadlines. Lowered per-item timeouts (view 20s, exec 40s) so 7 waves stay under the tool deadline, and named all four constants so the invariant is explicit (+ a test asserting it holds). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| tools | ||
| __init__.py | ||
| test_agent_factory_shell.py | ||
| test_agent_tool_registration.py | ||
| test_backend_retries.py | ||
| test_cli_target_list.py | ||
| test_config_loader.py | ||
| test_cost_tracking.py | ||
| test_docker_client_delete.py | ||
| test_execution.py | ||
| test_hooks.py | ||
| test_inputs.py | ||
| test_local_dir_staging.py | ||
| test_local_sources.py | ||
| test_models.py | ||
| test_notes.py | ||
| test_optional_deps.py | ||
| test_provider_hints.py | ||
| test_proxy_renderer.py | ||
| test_report_writer.py | ||
| test_reporting_fields.py | ||
| test_runner_rate_limit.py | ||
| test_runner_root_prompt.py | ||
| test_sarif.py | ||
| test_sarif_stride.py | ||
| test_session_entries.py | ||
| test_skill_dir_extension.py | ||
| test_state_repo_context.py | ||