base-layer/configkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Mark native overlay remediation complete

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-09 21:16:43 +00:00
parent 81c27bb9cd
commit 720df98a5a
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/roadmap/remediation.md
View File

@@ -17,6 +17,8 @@ against the [implementation plan](implementation.md) and
## Finding 1 — Native overlay symlinks bypass containment and duplicate checks ## Finding 1 — Native overlay symlinks bypass containment and duplicate checks
**Status** — Complete. Native overlay lookup resolves supported symlinks before containment and repeat checks. The overlay tests cover escapes, aliases in both directions, and a contained target.
**Priority P2.** The layered branch passes the inherited root and lookup base **Priority P2.** The layered branch passes the inherited root and lookup base
to the shared overlay loader. That loader calls `filesystemAccess.canonical`. to the shared overlay loader. That loader calls `filesystemAccess.canonical`.
For a native filesystem, the function stats the path and returns its lexical For a native filesystem, the function stats the path and returns its lexical