Rodin rodin
  • Joined on 2026-04-23
rodin commented on pull request rodin/review-bot#152 2026-05-16 01:10:34 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #1 (ACK-NOT-VALID): Acknowledged. The reviewer explicitly notes this is a known limitation of the os.SameFile pattern and that "no action is required" — the code comment already labels it defense-in-depth. No change needed.

rodin commented on pull request rodin/review-bot#152 2026-05-16 01:07:16 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #4 (ACK-NOT-VALID): os.Lstat is intentionally used here for consistency with checkStaleDocs, which also uses Lstat to avoid implicit symlink-follow semantics. Switching to Stat post-EvalSymlinks would be equivalent in practice but inconsistent with the rest of the file. Deliberate choice — no change needed.

rodin commented on pull request rodin/review-bot#152 2026-05-16 01:07:16 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #2 (ACK-NOT-VALID): Acknowledged. The reviewer confirms no issue — the ModeSymlink check removal is correct (the check was genuinely unreachable after filepath.EvalSymlinks), the comment is accurate, and this is a deliberate documented choice. No action needed.

rodin commented on pull request rodin/review-bot#152 2026-05-16 01:07:16 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #5 (ACK-NOT-VALID): User-facing error messages intentionally reference *docmapFlag (the original --docmap value) rather than the resolved path. Showing the resolved path would confuse users who specified a symlink — they would see a path they did not specify. Accepted UX tradeoff.

rodin commented on pull request rodin/review-bot#152 2026-05-16 01:06:45 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #1 (ACK-NOT-VALID): Acknowledged. The reviewer explicitly states this is a known limitation of the os.SameFile pattern and that "no action is required" — the code comment already labels it defense-in-depth. No code change needed.

rodin commented on pull request rodin/review-bot#152 2026-05-16 01:02:38 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #1 (ACK-NOT-VALID): Acknowledged. The reviewer explicitly notes this is a known limitation of os.SameFile and that "no action is required" — the code comment already labels it defense-in-depth. No change needed.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:58:57 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #5 (ACK-NOT-VALID): User-facing error messages intentionally reference *docmapFlag (the original --docmap value) rather than the resolved path. Showing the resolved path in errors would confuse users who specified a symlink — they want to see the path they actually provided.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:58:52 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #4 (ACK-NOT-VALID): os.Lstat is intentionally used here for consistency with checkStaleDocs, which also uses Lstat to avoid implicit symlink-follow semantics. Switching to Stat post-EvalSymlinks would be equivalent but would create an inconsistency within the file.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:58:47 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #2 (ACK-NOT-VALID): Acknowledged. The reviewer confirms no issue — the ModeSymlink removal is correct (the check was genuinely unreachable after EvalSymlinks), the comment is accurate, and the removal is a deliberate documented choice.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:58:01 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #1 (ACK-NOT-VALID): Acknowledged. The reviewer explicitly notes this is a known limitation of the os.SameFile pattern and that "no action is required" — the code comment already labels it defense-in-depth. No code change needed.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:54:20 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #5 (ACK-NOT-VALID): User-facing error messages intentionally reference *docmapFlag (the original --docmap value) for user clarity — showing a resolved path the user never specified would be surprising. The reviewer notes this is acceptable. No change needed.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:54:15 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #4 (ACK-NOT-VALID): os.Lstat is intentionally used here for consistency with checkStaleDocs, which also uses Lstat to avoid implicit symlink follow. Mixing Stat/Lstat in the same file would be more confusing than the minor clarity benefit. The reviewer notes this is fine and the PR is approved.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:54:09 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #2 (ACK-NOT-VALID): Acknowledged. The ModeSymlink guard was genuinely unreachable after EvalSymlinks and its removal is correct. The comment accurately documents why. The reviewer confirms this is a deliberate, documented choice — no issue.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:54:05 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Finding #1 (ACK-NOT-VALID): Acknowledged. This is a known OS-level limitation of the os.SameFile pattern documented in the code comment as defense-in-depth. The reviewer explicitly states "no action required." The code is correct as-is.

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:51:49 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

Test review with inline comment

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:51:49 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

TEST REPLY to finding

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:50:35 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

TEST: ACK-NOT-VALID — test reply to thread 27980

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:48:21 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

All findings from the current HEAD round (sonnet/4814, security/4816, gpt/4817 against eb0ff3aa) have been addressed:

Thread 27980 (sonnet NIT — os.SameFile TOCTOU limitation): ACK-NOT-VALI…

rodin commented on pull request rodin/review-bot#152 2026-05-16 00:47:25 +00:00
fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass

test reply 2