Prevent writing outside of the workspace roots #6178

scidomino · 2025-08-13T20:34:15Z

TLDR

Closes a security hole that allowed the agent to use symlinks to write outside the workspace.

Dive Deeper

#4605 prevented reading outside the workspace but didn't fully resolve non-existent paths allowing the agent to write.

Reviewer Test Plan

Ask GCLI to create a symlink to an outside dir and then ask it to write a file to it.

Testing Matrix

	🍏	🪟	🐧
npm run	x	❓	❓
npx	❓	❓	❓
Docker	❓	❓	❓
Podman	❓	-	-
Seatbelt	❓	-	-

Linked issues / bugs

Fixes #1121

gemini-code-assist

Summary of Changes

Hello @scidomino, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a security vulnerability that allowed the agent to write files outside of its designated workspace roots by exploiting symbolic links, particularly with non-existent paths. It enhances path validation to ensure that even if a target path does not yet exist, its fully resolved and canonical location is checked against the workspace boundaries, preventing malicious writes.

Highlights

Enhanced Security for File Writes: Patches a security vulnerability where an agent could use symlinks to write files outside the defined workspace, specifically targeting scenarios where the destination path did not yet exist.
Robust Path Resolution: Introduces a new private utility method, fullyResolvedPath, which correctly resolves symbolic links and determines the canonical path, even for non-existent file paths, by catching and interpreting ENOENT errors from fs.realpathSync.
Improved Workspace Path Validation: Updates the isPathWithinWorkspace method to leverage the new fullyResolvedPath utility, ensuring that all path checks, regardless of whether the file exists, accurately verify if the path falls within the allowed workspace directories.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request aims to fix a security vulnerability that allows writing outside the workspace via symlinks. The approach is to fully resolve paths, including for non-existent files, before checking if they are within the workspace.

However, the current implementation of fullyResolvedPath is based on an incorrect assumption about the error object from fs.realpathSync, which leaves the vulnerability unfixed. I've provided a critical review comment with a corrected, recursive implementation that properly resolves paths even when they don't exist. This change is essential for the security fix to be effective.

packages/core/src/utils/workspaceContext.ts

github-actions · 2025-08-13T20:40:16Z

Code Coverage Summary

Package	Lines	Statements	Functions	Branches
CLI	73.75%	73.75%	80.11%	81.31%
Core	74.84%	74.84%	74.21%	83.42%

CLI Package - Full Text Report

-------------------|---------|----------|---------|---------|-------------------
File               | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s 
-------------------|---------|----------|---------|---------|-------------------
All files          |   73.75 |    81.31 |   80.11 |   73.75 |                   
 src               |   54.46 |    75.51 |   66.66 |   54.46 |                   
  gemini.tsx       |   31.11 |     62.5 |      50 |   31.11 | ...51-317,327-344 
  ...ractiveCli.ts |   93.22 |    71.42 |     100 |   93.22 | ...,71-73,119,122 
  ...ActiveAuth.ts |     100 |      100 |     100 |     100 |                   
 src/commands      |   94.11 |      100 |      50 |   94.11 |                   
  mcp.ts           |   94.11 |      100 |      50 |   94.11 | 26                
 src/commands/mcp  |   95.49 |    80.43 |    90.9 |   95.49 |                   
  add.ts           |   97.26 |    85.71 |     100 |   97.26 | 109-112,119       
  list.ts          |   90.56 |    80.76 |      80 |   90.56 | ...10-112,137-138 
  remove.ts        |     100 |    66.66 |     100 |     100 | 19-23             
 src/config        |   91.88 |    81.46 |    87.5 |   91.88 |                   
  auth.ts          |     100 |      100 |     100 |     100 |                   
  config.ts        |   97.31 |    89.18 |      70 |   97.31 | ...40,420,570-574 
  extension.ts     |   82.53 |    84.37 |     100 |   82.53 | ...99-103,112-113 
  keyBindings.ts   |     100 |      100 |     100 |     100 |                   
  sandboxConfig.ts |   51.35 |    16.66 |   66.66 |   51.35 | ...43,53-69,74-91 
  settings.ts      |   83.57 |    77.52 |   93.33 |   83.57 | ...91-392,452-453 
  ...ingsSchema.ts |     100 |      100 |     100 |     100 |                   
  ...tedFolders.ts |   90.67 |    76.92 |     100 |   90.67 | ...20,125-130,148 
 src/generated     |     100 |      100 |     100 |     100 |                   
  git-commit.ts    |     100 |      100 |     100 |     100 |                   
 src/patches       |       0 |        0 |       0 |       0 |                   
  is-in-ci.ts      |       0 |        0 |       0 |       0 | 1-17              
 src/services      |   61.42 |    88.13 |   72.22 |   61.42 |                   
  ...mandLoader.ts |     100 |      100 |     100 |     100 |                   
  ...andService.ts |     100 |      100 |     100 |     100 |                   
  ...mandLoader.ts |   92.09 |    91.89 |     100 |   92.09 | 176-181,250-257   
  ...omptLoader.ts |    9.39 |    57.14 |   33.33 |    9.39 | ...44-167,173-230 
  types.ts         |       0 |        0 |       0 |       0 | 1                 
 ...mpt-processors |   95.18 |    94.73 |     100 |   95.18 |                   
  ...tProcessor.ts |     100 |      100 |     100 |     100 |                   
  ...lProcessor.ts |   93.54 |    92.85 |     100 |   93.54 | 67-70             
  types.ts         |     100 |      100 |     100 |     100 |                   
 src/test-utils    |   90.38 |    81.81 |      75 |   90.38 |                   
  ...omMatchers.ts |   69.69 |       50 |      50 |   69.69 | 31-34,36-38,44-46 
  ...andContext.ts |     100 |      100 |     100 |     100 |                   
 src/ui            |   59.01 |    72.53 |   65.78 |   59.01 |                   
  App.tsx          |   57.77 |    61.61 |   38.46 |   57.77 | ...1132,1158-1187 
  ...tionNudge.tsx |    7.89 |      100 |       0 |    7.89 | 26-102            
  colors.ts        |   87.75 |      100 |      80 |   87.75 | 12-13,18-19,48-49 
  constants.ts     |     100 |      100 |     100 |     100 |                   
  keyMatchers.ts   |   95.65 |    95.65 |     100 |   95.65 | 29-30             
  ...tic-colors.ts |   89.47 |      100 |      80 |   89.47 | 15-16             
  types.ts         |     100 |      100 |     100 |     100 |                   
 src/ui/commands   |   85.16 |    83.28 |   87.27 |   85.16 |                   
  aboutCommand.ts  |     100 |    55.55 |     100 |     100 | 23-30             
  authCommand.ts   |     100 |      100 |     100 |     100 |                   
  bugCommand.ts    |   78.46 |    42.85 |     100 |   78.46 | 32-35,72-81       
  chatCommand.ts   |   94.16 |    83.33 |     100 |   94.16 | ...07-208,210-211 
  clearCommand.ts  |     100 |      100 |     100 |     100 |                   
  ...essCommand.ts |     100 |    88.88 |     100 |     100 | 69                
  copyCommand.ts   |     100 |      100 |     100 |     100 |                   
  corgiCommand.ts  |     100 |      100 |     100 |     100 |                   
  ...ryCommand.tsx |   70.12 |    73.07 |     100 |   70.12 | ...22-123,158-166 
  docsCommand.ts   |     100 |      100 |     100 |     100 |                   
  editorCommand.ts |     100 |      100 |     100 |     100 |                   
  ...onsCommand.ts |     100 |      100 |     100 |     100 |                   
  helpCommand.ts   |     100 |      100 |     100 |     100 |                   
  ideCommand.ts    |    55.6 |    77.27 |   44.44 |    55.6 | ...09-219,227-237 
  initCommand.ts   |     100 |      100 |     100 |     100 |                   
  mcpCommand.ts    |   82.29 |    82.95 |   83.33 |   82.29 | ...83-384,437-444 
  memoryCommand.ts |   99.09 |    92.85 |     100 |   99.09 | 93                
  ...acyCommand.ts |     100 |      100 |     100 |     100 |                   
  quitCommand.ts   |     100 |      100 |     100 |     100 |                   
  ...oreCommand.ts |   93.79 |    91.42 |     100 |   93.79 | 54-55,84-89       
  ...ngsCommand.ts |     100 |      100 |     100 |     100 |                   
  ...hubCommand.ts |   79.33 |    46.15 |     100 |   79.33 | ...16-119,122-125 
  statsCommand.ts  |   84.48 |       75 |     100 |   84.48 | 24-32             
  ...tupCommand.ts |     100 |      100 |     100 |     100 |                   
  themeCommand.ts  |     100 |      100 |     100 |     100 |                   
  toolsCommand.ts  |     100 |      100 |     100 |     100 |                   
  types.ts         |     100 |      100 |     100 |     100 |                   
  vimCommand.ts    |   44.44 |      100 |       0 |   44.44 | 14-24             
 src/ui/components |    71.3 |    84.61 |   73.07 |    71.3 |                   
  AboutBox.tsx     |     100 |       50 |     100 |     100 | 102               
  AsciiArt.ts      |     100 |      100 |     100 |     100 |                   
  AuthDialog.tsx   |   90.07 |    96.42 |      75 |   90.07 | 69-74,103-110     
  ...nProgress.tsx |   16.66 |      100 |       0 |   16.66 | 18-62             
  ...Indicator.tsx |   15.15 |      100 |       0 |   15.15 | 17-47             
  ...ryDisplay.tsx |   89.47 |    33.33 |     100 |   89.47 | 20-21             
  ...ryDisplay.tsx |   92.04 |    94.44 |     100 |   92.04 | 79-84,89          
  ...geDisplay.tsx |     100 |      100 |     100 |     100 |                   
  ...gProfiler.tsx |      24 |      100 |       0 |      24 | 13-36             
  ...esDisplay.tsx |   10.52 |      100 |       0 |   10.52 | 24-82             
  ...ngsDialog.tsx |    7.29 |      100 |       0 |    7.29 | 27-172            
  ...ustDialog.tsx |     100 |      100 |     100 |     100 |                   
  Footer.tsx       |   84.68 |    82.35 |     100 |   84.68 | ...,89-91,135-142 
  ...ngSpinner.tsx |      80 |    33.33 |     100 |      80 | 29,31-32          
  Header.tsx       |   78.72 |    57.14 |     100 |   78.72 | 36-39,51-53,60-62 
  Help.tsx         |    3.27 |      100 |       0 |    3.27 | 17-173            
  ...emDisplay.tsx |      70 |    56.25 |     100 |      70 | ...59-64,84-91,94 
  InputPrompt.tsx  |   88.84 |    81.94 |     100 |   88.84 | ...94-496,599-603 
  ...Indicator.tsx |     100 |      100 |     100 |     100 |                   
  ...geDisplay.tsx |   25.92 |      100 |       0 |   25.92 | 14-36             
  ...tsDisplay.tsx |     100 |      100 |     100 |     100 |                   
  PrepareLabel.tsx |      60 |       80 |     100 |      60 | 35-48             
  ...ryDisplay.tsx |     100 |      100 |     100 |     100 |                   
  ...ngsDialog.tsx |   89.36 |    87.01 |     100 |   89.36 | ...23-336,342-358 
  ...ionDialog.tsx |   85.29 |      100 |   33.33 |   85.29 | 36-39,44-51       
  ...Indicator.tsx |   44.44 |      100 |       0 |   44.44 | 12-17             
  ...MoreLines.tsx |      60 |       25 |     100 |      60 | 24-27,33-40       
  StatsDisplay.tsx |   98.39 |    86.66 |     100 |   98.39 | 173-175           
  ...nsDisplay.tsx |   88.05 |    71.42 |     100 |   88.05 | 36-41,96-98       
  ThemeDialog.tsx  |    5.33 |      100 |       0 |    5.33 | 34-310            
  Tips.tsx         |      16 |      100 |       0 |      16 | 17-45             
  ...tsDisplay.tsx |     100 |     87.5 |     100 |     100 | 30-31             
  ...ification.tsx |   36.36 |      100 |       0 |   36.36 | 15-22             
 ...nents/messages |   63.15 |     81.3 |   57.14 |   63.15 |                   
  ...onMessage.tsx |   18.51 |      100 |       0 |   18.51 | 22-49             
  DiffRenderer.tsx |   96.18 |    81.92 |     100 |   96.18 | ...16-217,221,283 
  ErrorMessage.tsx |     100 |      100 |     100 |     100 |                   
  ...niMessage.tsx |   18.51 |      100 |       0 |   18.51 | 20-43             
  ...geContent.tsx |   19.04 |      100 |       0 |   19.04 | 25-43             
  InfoMessage.tsx  |     100 |      100 |     100 |     100 |                   
  ...onMessage.tsx |   35.87 |     62.5 |      20 |   35.87 | ...64-199,238-266 
  ...upMessage.tsx |   10.11 |      100 |       0 |   10.11 | 27-126            
  ToolMessage.tsx  |   87.76 |       80 |     100 |   87.76 | ...,91-95,169-171 
  UserMessage.tsx  |     100 |      100 |     100 |     100 |                   
  ...llMessage.tsx |   36.36 |      100 |       0 |   36.36 | 17-25             
 ...ponents/shared |    80.8 |    76.41 |   95.45 |    80.8 |                   
  MaxSizedBox.tsx  |   81.14 |     82.2 |   88.88 |   81.14 | ...08-509,614-615 
  ...tonSelect.tsx |   80.92 |    65.78 |     100 |   80.92 | ...52,155-156,226 
  text-buffer.ts   |   78.17 |    78.28 |   96.77 |   78.17 | ...1821,1861,1911 
  ...er-actions.ts |   86.71 |    67.79 |     100 |   86.71 | ...08-609,810-812 
 src/ui/contexts   |   86.73 |    76.66 |     100 |   86.73 |                   
  ...owContext.tsx |   91.07 |    81.81 |     100 |   91.07 | 46-47,59-61       
  ...onContext.tsx |   94.11 |      100 |     100 |   94.11 | 101-104           
  ...gsContext.tsx |   83.33 |       50 |     100 |   83.33 | 17-18             
  ...ngContext.tsx |   71.42 |       50 |     100 |   71.42 | 17-20             
  ...deContext.tsx |   76.08 |       50 |     100 |   76.08 | 46-47,51-58,76-77 
 src/ui/editors    |   93.18 |    85.71 |   66.66 |   93.18 |                   
  ...ngsManager.ts |   93.18 |    85.71 |   66.66 |   93.18 | 48,62-63          
 src/ui/hooks      |   78.67 |    82.09 |   83.33 |   78.67 |                   
  ...dProcessor.ts |    78.4 |       79 |     100 |    78.4 | ...55-458,469-487 
  ...dProcessor.ts |   96.23 |    72.97 |     100 |   96.23 | ...10-211,216-217 
  ...dProcessor.ts |   82.16 |    71.42 |   83.33 |   82.16 | ...70-374,440-468 
  ...Completion.ts |   92.73 |    89.47 |     100 |   92.73 | ...85-186,219-222 
  ...uthCommand.ts |    7.46 |      100 |       0 |    7.46 | 18-92             
  ...tIndicator.ts |     100 |      100 |     100 |     100 |                   
  ...ketedPaste.ts |     100 |      100 |     100 |     100 |                   
  ...ompletion.tsx |   94.73 |    81.81 |     100 |   94.73 | ...98-199,201-202 
  useCompletion.ts |    92.4 |     87.5 |     100 |    92.4 | ...,95-96,100-101 
  ...leMessages.ts |   98.68 |       95 |     100 |   98.68 | 55                
  ...orSettings.ts |     100 |      100 |     100 |     100 |                   
  useFocus.ts      |     100 |      100 |     100 |     100 |                   
  ...olderTrust.ts |     100 |      100 |     100 |     100 |                   
  ...miniStream.ts |   73.52 |    71.32 |     100 |   73.52 | ...41-842,872-962 
  ...BranchName.ts |   91.66 |    84.61 |     100 |   91.66 | 57-63             
  ...oryManager.ts |   98.41 |    93.33 |     100 |   98.41 | 43                
  ...putHistory.ts |    92.5 |    85.71 |     100 |    92.5 | 62-63,71,93-95    
  useKeypress.ts   |   57.71 |    86.88 |      80 |   57.71 | ...46-292,399-401 
  ...rdProtocol.ts |     100 |      100 |     100 |     100 |                   
  ...gIndicator.ts |     100 |      100 |     100 |     100 |                   
  useLogger.ts     |      25 |      100 |       0 |      25 | 14-32             
  ...raseCycler.ts |   95.45 |       75 |     100 |   95.45 | ...64-165,183-185 
  ...cySettings.ts |     3.6 |      100 |       0 |     3.6 | 18-139            
  ...lScheduler.ts |   79.29 |    94.59 |     100 |   79.29 | ...06-209,295-305 
  ...oryCommand.ts |       0 |        0 |       0 |       0 | 1-7               
  ...ompletion.tsx |     100 |     92.3 |     100 |     100 | 78                
  ...ngsCommand.ts |    87.5 |      100 |     100 |    87.5 | 13,17             
  ...ellHistory.ts |   91.26 |       80 |     100 |   91.26 | ...67,112-113,123 
  ...oryCommand.ts |       0 |        0 |       0 |       0 | 1-75              
  ...Completion.ts |      94 |    92.53 |     100 |      94 | 58-61,69-72,93    
  ...tateAndRef.ts |   59.09 |      100 |     100 |   59.09 | 23-31             
  ...rminalSize.ts |   18.18 |      100 |       0 |   18.18 | 12-32             
  ...emeCommand.ts |   46.98 |       75 |     100 |   46.98 | ...4,70-71,77-100 
  useTimer.ts      |   88.09 |    85.71 |     100 |   88.09 | 44-45,51-53       
  vim.ts           |   83.57 |     79.5 |     100 |   83.57 | ...38,742-750,759 
 src/ui/privacy    |   14.52 |      100 |       0 |   14.52 |                   
  ...acyNotice.tsx |   10.38 |      100 |       0 |   10.38 | 21-117            
  ...acyNotice.tsx |   14.28 |      100 |       0 |   14.28 | 16-59             
  ...acyNotice.tsx |   12.19 |      100 |       0 |   12.19 | 16-62             
  ...acyNotice.tsx |   30.76 |      100 |       0 |   30.76 | 19-36,39-41       
 src/ui/themes     |   99.48 |    65.38 |     100 |   99.48 |                   
  ansi-light.ts    |     100 |      100 |     100 |     100 |                   
  ansi.ts          |     100 |      100 |     100 |     100 |                   
  atom-one-dark.ts |     100 |      100 |     100 |     100 |                   
  ayu-light.ts     |     100 |      100 |     100 |     100 |                   
  ayu.ts           |     100 |      100 |     100 |     100 |                   
  color-utils.ts   |     100 |      100 |     100 |     100 |                   
  default-light.ts |     100 |      100 |     100 |     100 |                   
  default.ts       |     100 |      100 |     100 |     100 |                   
  dracula.ts       |     100 |      100 |     100 |     100 |                   
  github-dark.ts   |     100 |      100 |     100 |     100 |                   
  github-light.ts  |     100 |      100 |     100 |     100 |                   
  googlecode.ts    |     100 |      100 |     100 |     100 |                   
  no-color.ts      |     100 |      100 |     100 |     100 |                   
  ...tic-tokens.ts |     100 |      100 |     100 |     100 |                   
  ...-of-purple.ts |     100 |      100 |     100 |     100 |                   
  theme-manager.ts |   91.08 |    78.04 |     100 |   91.08 | ...91,195,220-221 
  theme.ts         |     100 |     41.3 |     100 |     100 | 225-240           
  xcode.ts         |     100 |      100 |     100 |     100 |                   
 src/ui/utils      |   62.68 |    85.49 |   81.96 |   62.68 |                   
  ...Colorizer.tsx |   77.24 |       80 |     100 |   77.24 | ...51-154,190-216 
  ...olePatcher.ts |      96 |       75 |     100 |      96 | 59-60             
  ...nRenderer.tsx |   26.51 |       75 |     100 |   26.51 | 32-137            
  ...wnDisplay.tsx |   85.84 |    87.69 |     100 |   85.84 | ...72-280,313-336 
  ...eRenderer.tsx |   78.09 |    76.19 |     100 |   78.09 | 55-83             
  ...boardUtils.ts |   32.25 |     37.5 |     100 |   32.25 | ...55-114,129-145 
  commandUtils.ts  |   97.36 |     92.3 |     100 |   97.36 | 68,72             
  computeStats.ts  |     100 |      100 |     100 |     100 |                   
  displayUtils.ts  |     100 |      100 |     100 |     100 |                   
  formatters.ts    |   90.47 |    95.83 |     100 |   90.47 | 57-60             
  isNarrowWidth.ts |     100 |      100 |     100 |     100 |                   
  ...olDetector.ts |   13.88 |      100 |      50 |   13.88 | 16-97             
  ...nUtilities.ts |   69.84 |    85.71 |     100 |   69.84 | 75-91,100-101     
  ...mConstants.ts |     100 |      100 |     100 |     100 |                   
  terminalSetup.ts |    4.03 |      100 |       0 |    4.03 | 40-340            
  textUtils.ts     |   88.88 |    83.33 |     100 |   88.88 | 14-15             
  updateCheck.ts   |     100 |    80.95 |     100 |     100 | 26-38             
 src/utils         |   45.54 |    92.09 |   85.71 |   45.54 |                   
  checks.ts        |   33.33 |      100 |       0 |   33.33 | 23-28             
  cleanup.ts       |      96 |    85.71 |     100 |      96 | 35                
  ...ScopeUtils.ts |     100 |      100 |     100 |     100 |                   
  events.ts        |     100 |      100 |     100 |     100 |                   
  gitUtils.ts      |   94.66 |    82.35 |     100 |   94.66 | 75-78             
  ...AutoUpdate.ts |   81.14 |    95.23 |   66.66 |   81.14 | 85-99,125-132     
  ...lationInfo.ts |     100 |      100 |     100 |     100 |                   
  package.ts       |   88.88 |       80 |     100 |   88.88 | 33-34             
  readStdin.ts     |    2.43 |      100 |       0 |    2.43 | 7-51              
  resolvePath.ts   |   66.66 |       25 |     100 |   66.66 | 12-13,16,18-19    
  sandbox.ts       |       0 |        0 |       0 |       0 | 1-945             
  settingsUtils.ts |   84.48 |    93.68 |   96.55 |   84.48 | ...05-306,357-401 
  spawnWrapper.ts  |     100 |      100 |     100 |     100 |                   
  ...upWarnings.ts |   23.07 |      100 |       0 |   23.07 | 14-40             
  ...entEmitter.ts |     100 |      100 |     100 |     100 |                   
  ...upWarnings.ts |     100 |      100 |     100 |     100 |                   
  version.ts       |     100 |       50 |     100 |     100 | 11                
 ...ed-integration |   26.06 |        0 |       0 |   26.06 |                   
  acp.ts           |    2.89 |        0 |       0 |    2.89 | ...52-288,291-338 
  schema.ts        |     100 |      100 |     100 |     100 |                   
  ...ntegration.ts |    3.29 |        0 |       0 |    3.29 | ...89-784,799-849 
-------------------|---------|----------|---------|---------|-------------------

Core Package - Full Text Report

-------------------|---------|----------|---------|---------|-------------------
File               | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s 
-------------------|---------|----------|---------|---------|-------------------
All files          |   74.84 |    83.42 |   74.21 |   74.84 |                   
 src               |     100 |      100 |     100 |     100 |                   
  index.ts         |     100 |      100 |     100 |     100 |                   
 src/__mocks__/fs  |     100 |      100 |     100 |     100 |                   
  promises.ts      |     100 |      100 |     100 |     100 |                   
 src/code_assist   |   72.15 |    76.19 |   71.05 |   72.15 |                   
  codeAssist.ts    |   18.51 |      100 |       0 |   18.51 | 13-35             
  converter.ts     |   89.23 |    96.15 |   81.81 |   89.23 | 178-182,201-211   
  oauth2.ts        |   75.23 |     61.7 |      80 |   75.23 | ...03-409,416-417 
  server.ts        |    50.6 |       80 |   53.84 |    50.6 | ...73-214,217-219 
  setup.ts         |   86.66 |    78.94 |     100 |   86.66 | ...,92-94,118-124 
  types.ts         |     100 |      100 |     100 |     100 |                   
 src/config        |   75.72 |     87.5 |    48.1 |   75.72 |                   
  config.ts        |   75.48 |     87.5 |    48.1 |   75.48 | ...31-738,744-745 
  models.ts        |     100 |      100 |     100 |     100 |                   
 src/core          |   75.09 |    77.96 |   73.01 |   75.09 |                   
  client.ts        |   81.29 |    77.48 |   77.77 |   81.29 | ...72,874-875,878 
  ...tGenerator.ts |   91.76 |    78.26 |     100 |   91.76 | 82-83,133,142-145 
  ...lScheduler.ts |   68.07 |    70.83 |   77.27 |   68.07 | ...60-867,870-880 
  geminiChat.ts    |   59.36 |    70.83 |   53.57 |   59.36 | ...06-607,610-611 
  geminiRequest.ts |     100 |      100 |     100 |     100 |                   
  logger.ts        |   85.96 |    83.33 |     100 |   85.96 | ...60-261,277-281 
  ...tGenerator.ts |   15.97 |      100 |      20 |   15.97 | ...51-179,182-183 
  ...olExecutor.ts |   90.07 |       50 |     100 |   90.07 | 84-85,87-96,127   
  prompts.ts       |   95.76 |    96.96 |      50 |   95.76 | 37-38,304-361     
  subagent.ts      |   92.18 |    83.75 |     100 |   92.18 | ...05-613,656-657 
  tokenLimits.ts   |   14.28 |      100 |       0 |   14.28 | 15-32             
  turn.ts          |   83.57 |    83.33 |     100 |   83.57 | ...55-258,271-272 
 src/generated     |     100 |      100 |     100 |     100 |                   
  git-commit.ts    |     100 |      100 |     100 |     100 |                   
 src/ide           |   44.33 |    87.09 |   48.57 |   44.33 |                   
  constants.ts     |     100 |      100 |     100 |     100 |                   
  detect-ide.ts    |   49.35 |      100 |      50 |   49.35 | 23-62             
  ide-client.ts    |   28.97 |    92.85 |    23.8 |   28.97 | ...71-395,398-402 
  ide-installer.ts |   58.76 |    53.33 |     100 |   58.76 | ...82,104-117,126 
  ideContext.ts    |   83.65 |      100 |     100 |   83.65 | 74-90             
  process-utils.ts |   14.28 |      100 |       0 |   14.28 | 21-62             
 src/mcp           |    74.2 |    80.16 |   76.31 |    74.2 |                   
  ...h-provider.ts |   86.36 |      100 |   33.33 |   86.36 | ...85,89,93,97-98 
  ...h-provider.ts |      77 |    65.62 |      90 |      77 | ...61-663,668-670 
  ...en-storage.ts |     100 |      100 |     100 |     100 |                   
  oauth-utils.ts   |   42.85 |     87.5 |      80 |   42.85 | ...32-192,216-252 
 src/mocks         |     100 |      100 |     100 |     100 |                   
  msw.ts           |     100 |      100 |     100 |     100 |                   
 src/prompts       |   26.41 |      100 |      25 |   26.41 |                   
  mcp-prompts.ts   |   18.18 |      100 |       0 |   18.18 | 11-19             
  ...t-registry.ts |   28.57 |      100 |   28.57 |   28.57 | ...42,48-55,68-73 
 src/services      |   94.93 |    94.85 |   86.84 |   94.93 |                   
  ...eryService.ts |   93.33 |    88.46 |   85.71 |   93.33 | 31,39,84,109-110  
  gitService.ts    |   77.52 |      100 |      60 |   77.52 | ...08-112,115-119 
  ...ionService.ts |   99.23 |    97.05 |     100 |   99.23 | 287-288           
  ...ionService.ts |   98.63 |    92.85 |     100 |   98.63 | 163-164           
 src/telemetry     |   62.62 |    76.29 |   67.64 |   62.62 |                   
  constants.ts     |     100 |      100 |     100 |     100 |                   
  ...-exporters.ts |   26.47 |      100 |       0 |   26.47 | ...80,83-84,87-88 
  index.ts         |     100 |      100 |     100 |     100 |                   
  ...t.circular.ts |       0 |        0 |       0 |       0 | 1-62              
  ...t.circular.ts |       0 |        0 |       0 |       0 | 1-125             
  loggers.ts       |   64.61 |    69.56 |   64.28 |   64.61 | ...63-381,384-399 
  metrics.ts       |   61.98 |       96 |    62.5 |   61.98 | ...37-159,162-185 
  sdk.ts           |   73.38 |       25 |     100 |   73.38 | ...48,153-154,156 
  ...l-decision.ts |     100 |      100 |     100 |     100 |                   
  types.ts         |   69.25 |    75.67 |   72.72 |   69.25 | ...38-347,350-361 
  uiTelemetry.ts   |   99.24 |    95.45 |     100 |   99.24 | 118               
 ...learcut-logger |   73.98 |    78.26 |   64.28 |   73.98 |                   
  ...cut-logger.ts |   72.46 |    77.94 |   66.66 |   72.46 | ...82-783,786-789 
  ...tadata-key.ts |   88.05 |      100 |       0 |   88.05 | 234-244           
 src/test-utils    |    98.8 |    91.66 |     100 |    98.8 |                   
  config.ts        |     100 |      100 |     100 |     100 |                   
  ...aceContext.ts |     100 |      100 |     100 |     100 |                   
  tools.ts         |   97.77 |     87.5 |     100 |   97.77 | 61                
 src/tools         |   70.32 |    81.71 |   76.47 |   70.32 |                   
  diffOptions.ts   |     100 |      100 |     100 |     100 |                   
  edit.ts          |   81.45 |    82.89 |   85.71 |   81.45 | ...80-481,503-542 
  glob.ts          |   85.83 |    78.72 |    87.5 |   85.83 | ...29-236,313-314 
  grep.ts          |   58.86 |    78.75 |   78.57 |   58.86 | ...88-592,602-603 
  ls.ts            |   96.81 |    90.16 |     100 |   96.81 | 136-140,323-324   
  mcp-client.ts    |   35.85 |    80.48 |   38.09 |   35.85 | ...1176,1180-1183 
  mcp-tool.ts      |    93.8 |    92.75 |   88.23 |    93.8 | ...85-195,257-258 
  memoryTool.ts    |   83.94 |       82 |   88.88 |   83.94 | ...03-304,388-406 
  ...iable-tool.ts |     100 |    84.61 |     100 |     100 | 94,101            
  read-file.ts     |    95.9 |     92.3 |    87.5 |    95.9 | ...10-112,209-210 
  ...many-files.ts |   79.61 |    72.58 |   85.71 |   79.61 | ...04-505,512-513 
  shell.ts         |   83.87 |    73.13 |   88.88 |   83.87 | ...69-370,381-382 
  tool-error.ts    |     100 |      100 |     100 |     100 |                   
  tool-registry.ts |   47.89 |     67.5 |      60 |   47.89 | ...98-400,423-431 
  tools.ts         |   78.57 |    89.18 |   63.63 |   78.57 | ...48-449,465-471 
  web-fetch.ts     |   36.98 |    73.68 |   72.72 |   36.98 | ...53-354,359-360 
  web-search.ts    |   98.41 |    89.28 |     100 |   98.41 | 203-204           
  write-file.ts    |   82.46 |    79.68 |      75 |   82.46 | ...53-456,468-504 
 src/utils         |   85.46 |    87.14 |   89.01 |   85.46 |                   
  LruCache.ts      |   70.96 |     62.5 |     100 |   70.96 | 20-22,28,30-34    
  bfsFileSearch.ts |   89.02 |    90.47 |     100 |   89.02 | 86-94             
  browser.ts       |    8.69 |      100 |       0 |    8.69 | 17-53             
  editCorrector.ts |    77.3 |    61.11 |   91.66 |    77.3 | ...65-677,711,725 
  editor.ts        |   97.63 |    94.54 |     100 |   97.63 | 154,224,227-228   
  ...entContext.ts |     100 |      100 |     100 |     100 |                   
  errorParsing.ts  |     100 |     92.3 |     100 |     100 | 76,80,86          
  ...rReporting.ts |   83.72 |    84.61 |     100 |   83.72 | 82-86,107-115     
  errors.ts        |   39.02 |       60 |      75 |   39.02 | 21-25,41-57,61-67 
  fetch.ts         |   34.04 |      100 |       0 |   34.04 | 22-27,31-57       
  fileUtils.ts     |   95.25 |       90 |     100 |   95.25 | ...05-110,357-363 
  formatters.ts    |   54.54 |       50 |     100 |   54.54 | 12-16             
  ...eUtilities.ts |   96.03 |    95.83 |     100 |   96.03 | 28-29,57-58       
  ...rStructure.ts |   95.96 |    94.93 |     100 |   95.96 | ...14-117,345-347 
  ...noreParser.ts |     100 |    89.47 |     100 |     100 | 27,47             
  gitUtils.ts      |   51.21 |     90.9 |      50 |   51.21 | 40-41,50-73       
  ...yDiscovery.ts |   87.31 |    76.92 |   77.77 |   87.31 | ...33-334,337-338 
  ...tProcessor.ts |   93.63 |    88.75 |   84.61 |   93.63 | ...81-282,385-386 
  ...Inspectors.ts |     100 |      100 |     100 |     100 |                   
  ...kerChecker.ts |   83.33 |    83.33 |     100 |   83.33 | 64-65,75-80,88-94 
  partUtils.ts     |     100 |      100 |     100 |     100 |                   
  paths.ts         |   84.07 |    88.23 |      80 |   84.07 | ...92-193,201-202 
  ...rDetection.ts |    64.4 |    76.19 |     100 |    64.4 | ...4,88-89,99-100 
  retry.ts         |   62.55 |    73.21 |     100 |   62.55 | ...58-278,323-338 
  ...nStringify.ts |     100 |      100 |     100 |     100 |                   
  ...aValidator.ts |      80 |    57.14 |     100 |      80 | 23-24,26-27       
  ...r-launcher.ts |   78.57 |     87.5 |   66.66 |   78.57 | ...33,135,153-188 
  session.ts       |     100 |      100 |     100 |     100 |                   
  shell-utils.ts   |   95.21 |    93.57 |     100 |   95.21 | ...,94-95,142-144 
  summarizer.ts    |     100 |    88.88 |     100 |     100 | 91                
  ...emEncoding.ts |      98 |    94.11 |     100 |      98 | 106-107           
  testUtils.ts     |   84.44 |    72.72 |   83.33 |   84.44 | 27-28,34-35,70-72 
  textUtils.ts     |    12.5 |      100 |       0 |    12.5 | 15-34             
  user_account.ts  |   97.72 |    97.05 |     100 |   97.72 | 102-103           
  user_id.ts       |    75.6 |       60 |      75 |    75.6 | 19-20,28-33,46-48 
  ...aceContext.ts |    90.1 |    96.66 |   81.81 |    90.1 | 56-57,71-72,75-79 
 ...ils/filesearch |   97.24 |     93.2 |     100 |   97.24 |                   
  crawlCache.ts    |     100 |      100 |     100 |     100 |                   
  fileSearch.ts    |   95.58 |     90.9 |     100 |   95.58 | ...89-190,221-222 
  ignore.ts        |     100 |      100 |     100 |     100 |                   
  result-cache.ts  |     100 |     92.3 |     100 |     100 | 46                
-------------------|---------|----------|---------|---------|-------------------

For detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run.

cornmander · 2025-08-13T21:01:18Z

Can you add tests?

jacob314

Please also add a test to for this case.

scidomino · 2025-08-13T23:31:16Z

You were right to suggest adding tests. In doing so I realized there was another corner case we weren't covering. Working on that now.

packages/core/src/utils/workspaceContext.test.ts

scidomino · 2025-08-14T02:05:23Z

Ok! This is ready to review now. Sorry for the delay.

jacob314

Great to see these tests using real paths not excessive mocks!

I made the change requested

google-gemini#6178)

Co-authored-by: Jacob Richman <[email protected]>

scidomino requested a review from a team as a code owner August 13, 2025 20:34

gemini-code-assist bot reviewed Aug 13, 2025

View reviewed changes

packages/core/src/utils/workspaceContext.ts Show resolved Hide resolved

scidomino enabled auto-merge August 13, 2025 20:44

jacob314 reviewed Aug 13, 2025

View reviewed changes

scidomino force-pushed the tomm_symlink_write_fix branch from f96bc0f to 1c554f7 Compare August 13, 2025 23:30

scidomino force-pushed the tomm_symlink_write_fix branch from 1c554f7 to 461367c Compare August 14, 2025 01:15

cornmander previously requested changes Aug 14, 2025

View reviewed changes

packages/core/src/utils/workspaceContext.test.ts Outdated Show resolved Hide resolved

scidomino force-pushed the tomm_symlink_write_fix branch 3 times, most recently from d881781 to ca6a849 Compare August 14, 2025 01:47

Prevent writing outside of the workspace roots

1e4d4a5

scidomino force-pushed the tomm_symlink_write_fix branch from ca6a849 to 1e4d4a5 Compare August 14, 2025 01:58

Merge branch 'main' into tomm_symlink_write_fix

8a5207e

scidomino requested a review from cornmander August 14, 2025 22:42

jacob314 approved these changes Aug 14, 2025

View reviewed changes

Merge branch 'main' into tomm_symlink_write_fix

555559d

jacob314 approved these changes Aug 14, 2025

View reviewed changes

scidomino added this pull request to the merge queue Aug 14, 2025

Merged via the queue into main with commit 1a41ba7 Aug 14, 2025
33 of 34 checks passed

scidomino deleted the tomm_symlink_write_fix branch August 14, 2025 23:07

thacio added a commit to thacio/auditaria that referenced this pull request Aug 15, 2025

Merge Commit '1a41ba7': Prevent writing outside of the workspace roots (

55faa78

google-gemini#6178)

agarwalravikant pushed a commit to agarwalravikant/gemini-cli that referenced this pull request Aug 18, 2025

Prevent writing outside of the workspace roots (google-gemini#6178)

41861ce

Co-authored-by: Jacob Richman <[email protected]>

acoliver referenced this pull request in vybestack/llxprt-code Aug 18, 2025

Prevent writing outside of the workspace roots (#6178)

3f5e549

Co-authored-by: Jacob Richman <[email protected]>

JeongJaeSoon pushed a commit to JeongJaeSoon/gemini-cli that referenced this pull request Aug 21, 2025

Prevent writing outside of the workspace roots (google-gemini#6178)

c16871c

Co-authored-by: Jacob Richman <[email protected]>

involvex pushed a commit to involvex/gemini-cli that referenced this pull request Sep 11, 2025

Prevent writing outside of the workspace roots (google-gemini#6178)

b35127c

Co-authored-by: Jacob Richman <[email protected]>

reconsumeralization pushed a commit to reconsumeralization/gemini-cli that referenced this pull request Sep 19, 2025

Prevent writing outside of the workspace roots (google-gemini#6178)

d869f02

Co-authored-by: Jacob Richman <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Prevent writing outside of the workspace roots #6178

Prevent writing outside of the workspace roots #6178

Uh oh!

scidomino commented Aug 13, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

github-actions bot commented Aug 13, 2025 •

edited

Loading

Uh oh!

cornmander commented Aug 13, 2025

Uh oh!

jacob314 left a comment

Uh oh!

scidomino commented Aug 13, 2025

Uh oh!

Uh oh!

scidomino commented Aug 14, 2025

Uh oh!

jacob314 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Prevent writing outside of the workspace roots #6178

Prevent writing outside of the workspace roots #6178

Uh oh!

Conversation

scidomino commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TLDR

Dive Deeper

Reviewer Test Plan

Testing Matrix

Linked issues / bugs

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

github-actions bot commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Summary

Uh oh!

cornmander commented Aug 13, 2025

Uh oh!

jacob314 left a comment

Choose a reason for hiding this comment

Uh oh!

scidomino commented Aug 13, 2025

Uh oh!

Uh oh!

scidomino commented Aug 14, 2025

Uh oh!

jacob314 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

scidomino commented Aug 13, 2025 •

edited

Loading

github-actions bot commented Aug 13, 2025 •

edited

Loading