Harden Bazel codegen copy against symlink and hardlink outputs #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

Naveed8951 wants to merge 1 commit into cncf:main from Naveed8951:fix/bazel-codegen-symlink-exfiltration

Naveed8951 commented Jan 10, 2026

Summary

Harden language code generation to safely copy Bazel outputs.

Details

Refuse symlinks, hardlinks, and non-regular files
Ensure copied files resolve within expected bazel-bin paths
Fail closed on suspicious or unexpected outputs


          Harden Bazel codegen copy against symlink and hardlink outputs

b78ffd2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet