Repository navigation
🐛 fix(cache): reject untrusted cache paths - #213
Merged
gaborbernat merged 4 commits intoNov 3, 2026
Merged
Conversation
DiskCache can load interpreter metadata from a directory another user controls and then execute the path it names. Check directory and entry ownership before trusting cached data, and replace entries atomically so links cannot redirect writes.
A relative cache root passed ownership checks in one directory while a later working-directory change sent writes elsewhere. Bind the root when constructing DiskCache so the checked path is also used for I/O.
gaborbernat
enabled auto-merge (squash)
November 3, 2026 00:53
gaborbernat
disabled auto-merge
November 3, 2026 00:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DiskCache.py_info()used cache directories without checking who controlled them, andDiskContentStore.read()trusted their entries. On a shared cache root, another user could make discovery run an executable named by cached metadata. Discovery now declines untrusted directories and entries, and writes cache files without following existing links. This addresses draft advisory ANT-2026-LHUOM9M1.Cache directory ownership
The old cache lookup and clear paths accepted existing directories without checking their owner or permissions. The new check requires the cache root and both
py_infodirectories to belong to the current user or root and to deny writes by other users. It checks ancestors too; a sticky directory prevents other users from renaming a child they do not own. When the check fails, discovery queries the interpreter without using that disk cache.Cache entry handling
The old read and write paths accepted any readable entry and followed a link when writing. Entry reads now require a regular file with acceptable ownership and mode.
O_NOFOLLOWrejects links andO_NONBLOCKavoids waiting to open a FIFO. Writes use a private temporary file and replace the entry path, so a link there cannot redirect a write. Python creates these temporary files with access limited to the creating user.Behavior changes
On POSIX, discovery skips a cache in a directory another user owns or can write and logs a warning. It still queries the requested interpreter. If an entry fails the file checks, discovery tries to remove it and queries the interpreter again. A relative cache root is bound to the current directory when
DiskCacheis constructed. Platforms withoutos.geteuid, including Windows, retain the existing directory eligibility rule.Reported by Antigravity: ANT-2026-LHUOM9M1.