0xbyt4 2efd9bbac4 fix: resolve symlink bypass in write deny list on macOS ...

On macOS, /etc is a symlink to /private/etc. The _is_write_denied()
function resolves the input path with os.path.realpath() but the deny
list entries were stored as literal strings ("/etc/shadow"). This meant
the resolved path "/private/etc/shadow" never matched, allowing writes
to sensitive system files on macOS.

Fix: Apply os.path.realpath() to deny list entries at module load time
so both sides of the comparison use resolved paths.

Adds 19 regression tests in tests/tools/test_write_deny.py.

2026-02-26 13:30:55 +03:00

2.8 KiB

Raw Permalink Blame History

View Raw