test(security): Node + Go regression parity for GHSA-g6ww + GHSA-f396#558
Merged
Merged
Conversation
Brings SDK regression coverage in line with the existing Python tests (#539 / #540) and the Rust core test (src/boxlite/src/images/archive/extractor.rs::test_cve_symlink_escape_blocked). Node (vitest, *.integration.test.ts): - security-readonly-volume-remount: mounts a read-only host volume, runs `mount -o remount,rw` from inside the box, asserts the host file is unchanged. Counterpart of the Python remount test. - security-symlink-escape: builds a minimal malicious OCI layout inline (hand-rolled USTAR + sha256 + manifest/config/index, no new devDeps) and loads it via SimpleBox({ rootfsPath }), asserts no host file is written outside the extraction root. Go (//go:build boxlite_dev, *_integration_test.go): - security_readonly_volume_remount: same shape as the Node test, using WithVolumeReadOnly + box.Exec. - security_symlink_escape: uses stdlib archive/tar to build the malicious layer + json for the OCI layout, then rt.Create(..., WithRootfsPath(layoutDir)). C SDK regression coverage is intentionally skipped per sdks/c/tests/CMakeLists.txt: "lifecycle/execute/streaming/etc. tests were removed when the C SDK moved to the post-and-drain callback API; coverage of those code paths now lives in the Go SDK + runner integration suite." The new Go tests above cover the same C-FFI machinery from one layer up.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings SDK regression coverage in line with the existing Python tests (#539 / #540) and the Rust core test at
src/boxlite/src/images/archive/extractor.rs::test_cve_symlink_escape_blocked. Companion to the 2026-05-20 GHSA-f396 mapping correction (5-row "Affected products" matching GHSA-g6ww) and the v0.9.0 / v0.9.5 release-note Security sections that surface both advisories to the non-Dependabot cohort.Coverage matrix after this PR
security_enforcement.rstest_readonly_volume_remount.pyextractor.rs::test_cve_symlink_escape_blocked(unit)test_symlink_escape.pyFiles added
sdks/node/tests/security-readonly-volume-remount.integration.test.ts— mounts a host volumereadOnly: true, runsmount -o remount,rwfrom inside the box, asserts the host file is unchanged.sdks/node/tests/security-symlink-escape.integration.test.ts— builds a minimal malicious OCI layout inline (hand-rolled USTAR + sha256 + manifest/config/index, no new devDeps), loads it viaSimpleBox({ rootfsPath }), asserts no host file written outside the extraction root.sdks/go/security_readonly_volume_remount_integration_test.go— same shape as the Node test, usingWithVolumeReadOnly+box.Exec.sdks/go/security_symlink_escape_integration_test.go— uses stdlibarchive/tarto build the malicious layer +encoding/jsonfor the OCI layout, thenrt.Create(..., WithRootfsPath(layoutDir)).Why no C SDK tests
sdks/c/tests/CMakeLists.txtdocuments the upstream decision: "lifecycle/execute/streaming/etc. tests were removed when the C SDK moved to the post-and-drain callback API; coverage of those code paths now lives in the Go SDK + runner integration suite." Both PoCs need the callback-based full options API (boxlite_options_add_volume,boxlite_options_set_rootfs_path) — the simple API doesn't expose them. Re-introducing 150+ lines of callback/condvar plumbing per test contradicts the documented delegation; the new Go tests cover the same C-FFI machinery one layer up.How verification was done
go vet -tags boxlite_dev ./...passes from thesdks/gomodule root.make dev:node/make dev:go+ a VM runtime — not run here.Companion work (outside this PR)
gh api PATCHcorrectedGHSA-f396-4rp4-7v2j"Affected products" from a singlepip boxlite <= 0.8.2row to the 5-row shape that mirrors GHSA-g6ww (pip / npm / go / rustboxlite/ rustboxlite-cli, each< 0.9.0patched0.9.0).## Securitysection linking both GHSAs + CVEs.cargo auditusers (GitHub advisories don't auto-populate RustSec).