WORK-482
ID:WORK-482Status:ready

Migrate sandbox reads to ProjectFiles + close the src traversal gap

Move the sandbox example read seam (__sandboxReadFile family + preprocess sandbox hooks) onto the WORK-481 ProjectFiles provider, and route the sandbox src directory join through it so it inherits containment — closing the unguarded examplesDir + '/' + src path-traversal gap.

Priority:highComplexity:moderateMilestone:v0.27.0Source:SPEC-113
claude/v0-27-0-planning-sgq68k View source

Criteria completion

Criteria completion: 0 of 3 (0%) checked; tracking started on Jun 25, no incremental history yet0%25%50%75%100%Jun 25Jul 11

Tracking started Jun 25 — check back for trends.

Relationships

Implements 1
Related 3
Branches 3
claude/v0-27-0-planning-sgq68k current ready
changeset-release/main doneclaude/milestone-v0-27-0-yqiu8v donemain done
History 1
  1. 4eab338
    Created (ready)by bjornolofandersson

Scope

  • Hook family → provider — the transform-time __sandboxReadFile/__sandboxListDir/__sandboxDirExists variables and the preprocess-context sandbox hooks become a ProjectFiles (the hook shape is already identical — a rename + containment upgrade). Keep null-provider behaviour in tree mode when no provider is supplied.
  • src join containment — packages/runes/src/tags/sandbox.ts (examplesDir + '/' + src, currently unguarded string concat → assembleFromDirectory) resolves through the provider, so src="../…" is rejected by the provider's containment and surfaces the in-band sandbox error.
  • Regression test — {% sandbox src="../escape" %} resolves to the in-band error message in both fsProjectFiles and memoryProjectFiles.

Acceptance Criteria

  • Sandbox example resolution (transform __sandboxReadFile family + preprocess hooks) consumes ProjectFiles.
  • The sandbox src directory join inherits containment; {% sandbox src="../…" %} resolves to the in-band error message, with a regression test, in both providers.
  • Existing sandbox tests/showcases pass unchanged for well-formed src values.

Dependencies

  • WORK-481 — the ProjectFiles interface + providers.

References

  • SPEC-113 §3 (sandbox examples) — the unguarded join: packages/runes/src/tags/sandbox.ts, packages/runes/src/sandbox-sources.ts (assembleFromDirectory).