fix(tools): reject rss search alias entries

Author: fffonion

rss/tools/search_files.rss

@@ -782,6 +782,10 @@ fn walk_search(state: map, path: string, depth: int) -> map {
                         } else {
                             if probe_entries.length > 0 {
                                 drop_page = true;
+                            } else {
+                                if map_int(listed, "next_cursor", 0) > map_int(listed, "cursor", 0) {
+                                    drop_page = true;
+                                }
                             }
                         }
                     } else {

src/capabilities/confined_io.rs

@@ -225,7 +225,9 @@ mod unix {
             ));
         }
         if stat_u64(stat.st_nlink) > 1 {
-            return Err(path_denied("hard links are not permitted"));
+            return Err(path_denied(
+                "regular files with multiple hard links are not permitted",
+            ));
         }
         let file_len = stat_u64(stat.st_size);
         if limit == 0 || offset >= file_len {
@@ -321,18 +323,23 @@ mod unix {
                 truncated = true;
                 break;
             }
-            let Some(name) = std::str::from_utf8(name_bytes).ok().map(str::to_string) else {
-                consumed = consumed.saturating_add(1);
-                continue;
-            };
-            let (file_type, len) = match metadata_at(directory_fd, name_bytes) {
+            let (file_type, len, nlink) = match metadata_at(directory_fd, name_bytes) {
                 Ok(meta) => meta,
                 Err(error) if error.raw_os_error() == Some(libc::ENOENT) => {
                     consumed = consumed.saturating_add(1);
                     continue;
                 }
                 Err(error) => return Err(map_io("fs::enumerate", error)),
             };
+            if file_type == "file" && nlink > 1 {
+                return Err(path_denied(
+                    "regular files with multiple hard links are not permitted",
+                ));
+            }
+            let Some(name) = std::str::from_utf8(name_bytes).ok().map(str::to_string) else {
+                consumed = consumed.saturating_add(1);
+                continue;
+            };
             entries.push(ListEntry {
                 name,
                 file_type,
@@ -347,7 +354,10 @@ mod unix {
         })
     }
 
-    fn metadata_at(directory_fd: RawFd, name: &[u8]) -> Result<(&'static str, u64), io::Error> {
+    fn metadata_at(
+        directory_fd: RawFd,
+        name: &[u8],
+    ) -> Result<(&'static str, u64, u64), io::Error> {
         let name = CString::new(name).expect("validated component contains no NUL");
         let mut stat = MaybeUninit::<libc::stat>::uninit();
         let result = unsafe {
@@ -369,7 +379,7 @@ mod unix {
             libc::S_IFLNK => "symlink",
             _ => "other",
         };
-        Ok((file_type, stat_u64(stat.st_size)))
+        Ok((file_type, stat_u64(stat.st_size), stat_u64(stat.st_nlink)))
     }
 
     fn clear_errno() {

tests/capability_tests.rs

@@ -1988,3 +1988,105 @@ fn list_examination_budget_counts_non_utf8_slots() {
         }
     }
 }
+
+#[cfg(unix)]
+#[test]
+fn list_consumed_non_utf8_only_page_advances_next_cursor() {
+    use std::ffi::OsString;
+    use std::os::unix::ffi::OsStringExt;
+
+    let fixture = Fixture::new("list-non-utf8-only");
+    fs::create_dir(fixture.root.join("dir")).expect("dir");
+    fs::write(
+        fixture
+            .root
+            .join("dir")
+            .join(OsString::from_vec(vec![0xff, 0x80])),
+        "secret",
+    )
+    .expect("invalid name");
+    let listed = fixture
+        .filesystem()
+        .list(&fixture.token(CapabilityRisk::Read), "dir", 0, 1)
+        .expect("list");
+    assert!(
+        listed.entries.is_empty(),
+        "omitted invalid-byte names must not appear: {:?}",
+        listed.entries
+    );
+    assert!(
+        listed.next_cursor > listed.cursor,
+        "consumed-but-omitted dirents must advance next_cursor: {listed:?}"
+    );
+    assert!(
+        !listed.truncated,
+        "a single consumed-omitted dirent must not claim leftover pages: {listed:?}"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn list_rejects_regular_hardlinks_and_preserves_dirs_and_files() {
+    let fixture = Fixture::new("list-hardlink");
+    fs::create_dir(fixture.root.join("keep-dir")).expect("dir");
+    fs::write(fixture.root.join("keep.txt"), "ok").expect("keep");
+    let outside = fixture.root.parent().unwrap().join(format!(
+        "outside-shared-{}-{}",
+        std::process::id(),
+        NEXT_CAP_TMP.fetch_add(1, Ordering::Relaxed)
+    ));
+    fs::write(&outside, "shared").expect("outside");
+    fs::hard_link(&outside, fixture.root.join("linked")).expect("hard link");
+
+    let fs_cap = fixture.filesystem();
+    let token = fixture.token(CapabilityRisk::Read);
+    let error = fs_cap
+        .list(&token, "", 0, 4)
+        .expect_err("listing a regular hardlink must fail");
+    assert_eq!(error_code(&error), "path_denied");
+    assert_eq!(
+        error.message(),
+        "regular files with multiple hard links are not permitted"
+    );
+
+    let nested = fixture.root.join("keep-dir");
+    fs::write(nested.join("inner.txt"), "inner").expect("inner");
+    let listed = fs_cap
+        .list(&token, "keep-dir", 0, 4)
+        .expect("ordinary directory listing must succeed");
+    assert!(
+        listed
+            .entries
+            .iter()
+            .any(|entry| entry.name == "inner.txt" && entry.file_type == "file")
+    );
+    assert!(
+        listed.entries.iter().all(|entry| entry.name != "linked"),
+        "hardlinked names must not leak through a nested listing: {:?}",
+        listed.entries
+    );
+
+    let host_fs = Arc::new(fixture.filesystem());
+    let source = format!(
+        r#"
+        pub fn run(input: map) -> map {{
+            cap::fs_list("{token}", "", 0, 4)
+        }}
+    "#
+    );
+    let result = run_cap_source(&fixture, Some(host_fs), None, None, &source);
+    assert_eq!(envelope_error_code(&result), "path_denied");
+    let VmValue::Map(fields) = &result else {
+        panic!("expected map envelope, got {result:?}");
+    };
+    let Some(VmValue::Map(error)) = fields.get(&VmValue::string("error")) else {
+        panic!("expected error map, got {result:?}");
+    };
+    assert_eq!(
+        error.get(&VmValue::string("message")),
+        Some(&VmValue::string(
+            "regular files with multiple hard links are not permitted"
+        ))
+    );
+    let _ = fs::remove_file(&outside);
+}

tests/rss_file_tool_tests.rs

@@ -1986,6 +1986,179 @@ fn search_non_utf8_name_consumes_exam_slot_and_does_not_leak_secret() {
     );
 }
 
+#[cfg(unix)]
+#[test]
+fn search_remaining_2_invalid_byte_filename_truncates_like_native() {
+    use std::ffi::OsString;
+    use std::os::unix::ffi::OsStringExt;
+
+    let fixture = Fixture::new("search-rem2-invalid");
+    fs::write(
+        fixture
+            .root
+            .join(OsString::from_vec(vec![0xff, b'x', 0x80])),
+        "secret needle\n",
+    )
+    .unwrap();
+    let mut config = fixture.config();
+    config.max_search_files = 2;
+    config.artifact_store.root = fixture.parent.join("artifacts-rem2-invalid");
+    let arguments = json!({"pattern": "needle"});
+    let native = native_execute(
+        &fixture.tools_with_config(config.clone()),
+        NativeToolExecutor::SearchFiles,
+        &arguments,
+    );
+    let rss = run_rss_search(&fixture, &config, arguments);
+    assert_exact_envelope(&native, &rss.result);
+    assert!(native.ok, "native={native:?}");
+    assert!(native.truncated, "native must truncate: {native:?}");
+    assert_eq!(native.content, "");
+    assert_eq!(native.data["match_count"], json!(0));
+    assert_eq!(native.data["files_visited"], json!(0));
+    assert_eq!(native.data["dirs_visited"], json!(1));
+    assert_eq!(rss.result["truncated"], json!(true), "rss={}", rss.result);
+    assert_eq!(rss.result["content"], json!(""));
+    assert_eq!(rss.result["data"]["match_count"], json!(0));
+    assert_eq!(rss.result["data"]["files_visited"], json!(0));
+    assert_eq!(rss.result["data"]["dirs_visited"], json!(1));
+}
+
+#[cfg(unix)]
+#[test]
+fn search_nested_remaining_2_hidden_dirent_stops_later_siblings_like_native() {
+    use std::ffi::OsString;
+    use std::os::unix::ffi::OsStringExt;
+
+    let fixture = Fixture::new("search-nested-rem2-hidden");
+    fs::create_dir_all(fixture.root.join("adir")).unwrap();
+    fs::create_dir_all(fixture.root.join("bdir")).unwrap();
+    fs::create_dir_all(fixture.root.join("zdir")).unwrap();
+    fs::write(fixture.root.join("adir/f0.txt"), "needle\n").unwrap();
+    fs::write(fixture.root.join("adir/f1.txt"), "needle\n").unwrap();
+    fs::write(fixture.root.join("adir/f2.txt"), "needle\n").unwrap();
+    fs::write(
+        fixture
+            .root
+            .join("bdir")
+            .join(OsString::from_vec(vec![0xff, 0x80])),
+        "secret needle\n",
+    )
+    .unwrap();
+    fs::write(fixture.root.join("zdir/late.txt"), "needle late\n").unwrap();
+    let mut config = fixture.config();
+    config.max_search_files = 5;
+    config.artifact_store.root = fixture.parent.join("artifacts-nested-rem2-hidden");
+    let arguments = json!({"pattern": "needle"});
+    let native = native_execute(
+        &fixture.tools_with_config(config.clone()),
+        NativeToolExecutor::SearchFiles,
+        &arguments,
+    );
+    let rss = run_rss_search(&fixture, &config, arguments);
+    assert_exact_envelope(&native, &rss.result);
+    assert!(native.ok, "native={native:?}");
+    assert!(native.truncated, "native must truncate: {native:?}");
+    assert!(
+        native.content.contains("adir/f0.txt")
+            && native.content.contains("adir/f1.txt")
+            && native.content.contains("adir/f2.txt"),
+        "prior matches must remain: native={native:?}"
+    );
+    assert!(
+        !native.content.contains("late.txt"),
+        "later sibling must not be traversed after remaining<=2 hidden consumption: native={native:?}"
+    );
+    assert_eq!(native.data["files_visited"], json!(3));
+    assert_eq!(native.data["dirs_visited"], json!(3));
+    assert_eq!(rss.result["truncated"], json!(true), "rss={}", rss.result);
+    assert_eq!(rss.result["data"]["files_visited"], json!(3));
+    assert_eq!(rss.result["data"]["dirs_visited"], json!(3));
+    assert!(
+        !rss.result["content"]
+            .as_str()
+            .is_some_and(|content| content.contains("late.txt")),
+        "later sibling must not leak: rss={}",
+        rss.result
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn search_hardlink_only_directory_is_fatal_like_native() {
+    let fixture = Fixture::new("search-hardlink-only");
+    let outside = fixture.parent.join("outside-shared");
+    fs::write(&outside, "needle shared\n").unwrap();
+    fs::hard_link(&outside, fixture.root.join("linked")).unwrap();
+    let mut config = fixture.config();
+    config.artifact_store.root = fixture.parent.join("artifacts-hardlink-only");
+    let arguments = json!({"pattern": "needle"});
+    let native = native_execute(
+        &fixture.tools_with_config(config.clone()),
+        NativeToolExecutor::SearchFiles,
+        &arguments,
+    );
+    let rss = run_rss_search(&fixture, &config, arguments);
+    assert_exact_envelope(&native, &rss.result);
+    assert!(!native.ok, "native={native:?}");
+    let native_error = native.error.as_ref().expect("native error");
+    assert_eq!(native_error.code, "path_denied");
+    assert_eq!(
+        native_error.message,
+        "regular files with multiple hard links are not permitted"
+    );
+    assert_eq!(native.content, "");
+    assert_eq!(native.data, json!({}));
+    assert!(!native.truncated);
+    assert_eq!(rss.result["ok"], json!(false), "rss={}", rss.result);
+    assert_eq!(rss.result["error"]["code"], json!("path_denied"));
+    assert_eq!(
+        rss.result["error"]["message"],
+        json!("regular files with multiple hard links are not permitted")
+    );
+    assert_eq!(rss.result["content"], json!(""));
+}
+
+#[cfg(unix)]
+#[test]
+fn search_hardlink_in_child_discards_parent_matches_like_native() {
+    let fixture = Fixture::new("search-hardlink-child");
+    fs::write(fixture.root.join("a.txt"), "needle parent\n").unwrap();
+    fs::create_dir(fixture.root.join("sub")).unwrap();
+    let outside = fixture.parent.join("outside-shared");
+    fs::write(&outside, "needle child\n").unwrap();
+    fs::hard_link(&outside, fixture.root.join("sub/linked")).unwrap();
+    let mut config = fixture.config();
+    config.artifact_store.root = fixture.parent.join("artifacts-hardlink-child");
+    let arguments = json!({"pattern": "needle"});
+    let native = native_execute(
+        &fixture.tools_with_config(config.clone()),
+        NativeToolExecutor::SearchFiles,
+        &arguments,
+    );
+    let rss = run_rss_search(&fixture, &config, arguments);
+    assert_exact_envelope(&native, &rss.result);
+    assert!(
+        !native.ok,
+        "native must discard partial matches: {native:?}"
+    );
+    let native_error = native.error.as_ref().expect("native error");
+    assert_eq!(native_error.code, "path_denied");
+    assert_eq!(
+        native_error.message,
+        "regular files with multiple hard links are not permitted"
+    );
+    assert_eq!(native.content, "");
+    assert_eq!(native.data, json!({}));
+    assert!(
+        !rss.result["content"]
+            .as_str()
+            .is_some_and(|content| content.contains("a.txt")),
+        "parent matches must be discarded: rss={}",
+        rss.result
+    );
+}
+
 #[test]
 fn search_directory_order_is_byte_lexicographic_including_multibyte() {
     let fixture = Fixture::new("sort-multi");