Repository navigation
Conversation
Since Go 1.23, Windows junctions and mount points are no longer reported as symlinks, so filepath.EvalSymlinks fails with ERROR_PATH_NOT_FOUND below one and returns a trailing one unresolved. That broke ValidatePathWithinRoot for any repo under a junction or folder-mounted volume (e.g. a Dev Drive). Resolve paths with GetFinalPathNameByHandle on Windows instead. Fixes github#287 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
Windows long-path inputs can still fail validation, and Ubuntu-only CI leaves the Windows junction-containment tests unexecuted.
2 open issues
What changed in this PR
Updates repository-path validation to resolve Windows junctions and mounted volumes, addressing #287 while leaving other platforms unchanged.
Changes:
- Use handle-based Windows path resolution for repository containment checks.
- Add Windows tests for junction traversal, escape rejection, and path-prefix handling.
- Promote
golang.org/x/systo a direct dependency.
| File | Description |
|---|---|
internal/workflowfile/workflowfile.go |
Route containment checks through the platform-specific resolver. |
internal/workflowfile/evalsymlinks_windows.go |
Resolve Windows paths using GetFinalPathNameByHandle. |
internal/workflowfile/evalsymlinks_windows_test.go |
Test junction resolution, containment, and prefix trimming. |
internal/workflowfile/evalsymlinks_other.go |
Preserve filepath.EvalSymlinks behavior outside Windows. |
go.mod |
Declare golang.org/x/sys as a direct dependency. |
Review effort: Max (dynamic)
| // as non-directories, so it fails with ERROR_PATH_NOT_FOUND below one and | ||
| // returns a trailing one unresolved (golang/go#61893). | ||
| func evalSymlinks(path string) (string, error) { | ||
| p, err := windows.UTF16PtrFromString(path) |
Author
There was a problem hiding this comment.
Fixed in 6b81a0d. Absolute paths of 248+ characters now get the \\?\ prefix (\\?\UNC\ for UNC) before CreateFile, as os.Open does. Added a long-path test and a prefix table.
I couldn't reproduce the failure here (long paths are enabled), so the test covers the prefixed open, not the failure.
| }) | ||
| } | ||
|
|
||
| func TestValidatePathWithinRoot_Junction(t *testing.T) { |
filepath.EvalSymlinks went through os.Lstat, which switches long paths to the \?\ form. Calling CreateFile directly lost that, so without long-path opt-in a path past MAX_PATH could fail validation. Prefix long absolute paths the same way. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #287
Go 1.23 stopped treating Windows junctions and mount points as symlinks (golang/go#61893), so
filepath.EvalSymlinksfails below them and returns a trailing one unresolved.On Windows, resolve paths with
GetFinalPathNameByHandleinstead. Other platforms are unchanged.\\?\prefix, asos.Opendoes, so they still resolve without long-path opt-in.golang.org/x/sysbecomes a direct dependency.Testing
New Windows-only tests create junctions with
mklink /J. Onmain, four of the five containment cases and the repo-behind-junction case fail. CI is Linux-only, so these don't run there.Also ran the built binary on a repo under a folder-mounted volume: fails on
main, works with this change.On Windows,
go test ./...has the same 6 failures with and without this change (TestMigrateLocalActions_UnparseableWorkflowIsAFinding,TestPublicFallbackCredential).🤖 Generated with Claude Code