Skip to content

Reject symlink aliases for cancel source and destination - #94

Merged
SihaoLiu merged 2 commits into
devfrom
use-realpath4everything
Apr 17, 2026
Merged

Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom
use-realpath4everything

Conversation

@SihaoLiu

@SihaoLiuSihaoLiu commented Apr 17, 2026

Copy link
Copy Markdown
Contributor

Summary

Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.

  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.

Test plan

  • New HELPER TEST 9 covers the destination symlink alias attack
  • New HELPER TEST 10 covers the source symlink alias attack
  • Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed

@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu

SihaoLiu commented Apr 17, 2026

Copy link
Copy Markdown
ContributorAuthor

@codex review this PR

@chatgpt-codex-connector

chatgpt-codex-connectorBot commented Apr 17, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu

SihaoLiu commented Apr 17, 2026

Copy link
Copy Markdown
ContributorAuthor

@codex review this PR as entirety

@chatgpt-codex-connector

chatgpt-codex-connectorBot commented Apr 17, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@SihaoLiu
SihaoLiu merged commit 98d86c0 into devApr 17, 2026
9 checks passed
@SihaoLiuSihaoLiu mentioned this pull request Apr 21, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
Reject symlink aliases for cancel source and destination by SihaoLiu · Pull Request #94 · PolyArch/humanize · GitHub
Skip to content
Reject symlink aliases for cancel source and destination - #94
Merged
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Apr 17, 2026
Merged
Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Conversation
@SihaoLiu
@SihaoLiuSihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

Contributor
Summary
Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.
  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.
Test plan
  •  New HELPER TEST 9 covers the destination symlink alias attack
  •  New HELPER TEST 10 covers the source symlink alias attack
  •  Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed
@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Hooray!
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR as entirety
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
SihaoLiu
merged commit 98d86c0
into
devApr 17, 2026

9 checks passed

@SihaoLiuSihaoLiu
mentioned this pull request
Apr 21, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reject symlink aliases for cancel source and destination by SihaoLiu · Pull Request #94 · PolyArch/humanize · GitHub
Skip to content
Reject symlink aliases for cancel source and destination - #94
Merged
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Apr 17, 2026
Merged
Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Conversation
@SihaoLiu
@SihaoLiuSihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

Contributor
Summary
Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.
  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.
Test plan
  •  New HELPER TEST 9 covers the destination symlink alias attack
  •  New HELPER TEST 10 covers the source symlink alias attack
  •  Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed
@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Hooray!
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR as entirety
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
SihaoLiu
merged commit 98d86c0
into
devApr 17, 2026

9 checks passed

@SihaoLiuSihaoLiu
mentioned this pull request
Apr 21, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reject symlink aliases for cancel source and destination by SihaoLiu · Pull Request #94 · PolyArch/humanize · GitHub
Skip to content
Reject symlink aliases for cancel source and destination - #94
Merged
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Apr 17, 2026
Merged
Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Conversation
@SihaoLiu
@SihaoLiuSihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

Contributor
Summary
Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.
  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.
Test plan
  •  New HELPER TEST 9 covers the destination symlink alias attack
  •  New HELPER TEST 10 covers the source symlink alias attack
  •  Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed
@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Hooray!
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR as entirety
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
SihaoLiu
merged commit 98d86c0
into
devApr 17, 2026

9 checks passed

@SihaoLiuSihaoLiu
mentioned this pull request
Apr 21, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
Reject symlink aliases for cancel source and destination by SihaoLiu · Pull Request #94 · PolyArch/humanize · GitHub
Skip to content
Reject symlink aliases for cancel source and destination - #94
Merged
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Apr 17, 2026
Merged
Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Conversation
@SihaoLiu
@SihaoLiuSihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

Contributor
Summary
Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.
  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.
Test plan
  •  New HELPER TEST 9 covers the destination symlink alias attack
  •  New HELPER TEST 10 covers the source symlink alias attack
  •  Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed
@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Hooray!
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR as entirety
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
SihaoLiu
merged commit 98d86c0
into
devApr 17, 2026

9 checks passed

@SihaoLiuSihaoLiu
mentioned this pull request
Apr 21, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reject symlink aliases for cancel source and destination by SihaoLiu · Pull Request #94 · PolyArch/humanize · GitHub
Skip to content
Reject symlink aliases for cancel source and destination - #94
Merged
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Apr 17, 2026
Merged
Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Conversation
@SihaoLiu
@SihaoLiuSihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

Contributor
Summary
Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.
  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.
Test plan
  •  New HELPER TEST 9 covers the destination symlink alias attack
  •  New HELPER TEST 10 covers the source symlink alias attack
  •  Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed
@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Hooray!
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR as entirety
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
SihaoLiu
merged commit 98d86c0
into
devApr 17, 2026

9 checks passed

@SihaoLiuSihaoLiu
mentioned this pull request
Apr 21, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
Reject symlink aliases for cancel source and destination by SihaoLiu · Pull Request #94 · PolyArch/humanize · GitHub
Skip to content
Reject symlink aliases for cancel source and destination - #94
Merged
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Apr 17, 2026
Merged
Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Conversation
@SihaoLiu
@SihaoLiuSihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

Contributor
Summary
Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.
  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.
Test plan
  •  New HELPER TEST 9 covers the destination symlink alias attack
  •  New HELPER TEST 10 covers the source symlink alias attack
  •  Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed
@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Hooray!
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR as entirety
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
SihaoLiu
merged commit 98d86c0
into
devApr 17, 2026

9 checks passed

@SihaoLiuSihaoLiu
mentioned this pull request
Apr 21, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
Reject symlink aliases for cancel source and destination by SihaoLiu · Pull Request #94 · PolyArch/humanize · GitHub
Skip to content
Reject symlink aliases for cancel source and destination - #94
Merged
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Apr 17, 2026
Merged
Reject symlink aliases for cancel source and destination#94
SihaoLiu merged 2 commits into
devfrom 
use-realpath4everything
Conversation
@SihaoLiu
@SihaoLiuSihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

Contributor
Summary
Follow-up to the canonicalize-paths work already merged into dev via #93. Codex review on that PR flagged a P1 path-restriction bypass: using full-path realpath on the user-provided mv source and destination in is_cancel_authorized lets a symlink aliasing <loop>/state.md or <loop>/cancel-state.md pass authorization. For the destination case this is exploitable — mv <loop>/state.md /tmp/link where /tmp/link -> <loop>/cancel-state.md canonicalizes to the expected path and passes the check, but mv replaces the link at /tmp/link rather than creating <loop>/cancel-state.md, corrupting loop state and depositing state.md outside the loop dir.
  • Introduce canonicalize_path_prefix in hooks/lib/project-root.sh that resolves symlinks only in the parent directory and preserves the basename verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still match a canonical expected path, but a symlink at the leaf no longer impersonates the real filename.
  • Rewire is_cancel_authorized to use the prefix-only helper for both src and dest. Document the distinction in-place. Update the on-disk src_original probe to reference canonical_loop_dir so the symlink-rejection check runs against the real path.
Test plan
  •  New HELPER TEST 9 covers the destination symlink alias attack
  •  New HELPER TEST 10 covers the source symlink alias attack
  •  Existing HELPER TEST 8 (symlinked prefix) still passes, proving prefix resolution still works
  • bash tests/run-all-tests.sh -> 1725 passed / 0 failed
@SihaoLiu
Reject symlink aliases for cancel source and destination
b10fbf1
Using realpath-with-leaf-dereference on the user-provided mv source and
destination lets a symlink aliasing <loop>/state.md or
<loop>/cancel-state.md pass authorization. For the destination case
the vulnerability is exploitable: `mv <loop>/state.md /tmp/link` (where
/tmp/link -> <loop>/cancel-state.md) canonicalizes to the expected
path and passes the check, but `mv` replaces the link at /tmp/link
rather than creating <loop>/cancel-state.md, corrupting loop state and
depositing state.md outside the loop dir.
Introduce canonicalize_path_prefix in project-root.sh that resolves
symlinks ONLY in the parent directory and preserves the basename
verbatim. Symlinked project prefixes (e.g. /var vs /private/var) still
match a canonical expected path, but a symlink at the leaf no longer
impersonates the real filename. Rewire is_cancel_authorized to use
the prefix-only helper for both src and dest, and document why the
distinction matters in-place. Update the on-disk src_original probe
to reference canonical_loop_dir so the symlink-rejection check runs
against the real path rather than any user-supplied non-canonical form.
Add two regression tests covering the destination and source symlink
alias attacks.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. Hooray!
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
Use prefix-only canonicalization in read/write path validators
cf17140
The main FILE_PATH vs CORRECT_PATH comparison in loop-read-validator.sh
and loop-write-validator.sh previously used canonicalize_path, which
dereferences symlinks at the leaf. A planted symlink at the correct
filename inside the loop dir would then canonicalize to its target and
let the validator approve a Read or Write that follows the link out of
the loop dir, expanding Claude's effective file-access reach beyond
what the hook intends to permit.
Switch both validators to canonicalize_path_prefix so a symlinked
project ancestor still resolves correctly (the original bug this
feature fixes) while a symlink at the leaf no longer impersonates the
expected filename. This matches the same discipline applied to
is_cancel_authorized and preserves the intended semantics that the
basename is compared verbatim.
Methodology-analysis checks in these validators intentionally keep
full-path realpath because they use prefix-containment (path starts
with loop-dir/) rather than equality, which correctly catches symlinks
escaping the loop dir.
@SihaoLiu
SihaoLiu
commented
Apr 17, 2026

Copy link


Copy Markdown

ContributorAuthor
@codex review this PR as entirety
@chatgpt-codex-connector
chatgpt-codex-connectorBot
commented
Apr 17, 2026

Copy link


Copy Markdown

Codex Review: Didn't find any major issues. You're on a roll.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@SihaoLiu
SihaoLiu
merged commit 98d86c0
into
devApr 17, 2026

9 checks passed

@SihaoLiuSihaoLiu
mentioned this pull request
Apr 21, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@SihaoLiu