fix(security): fail closed on non-ENOENT realpath errors (#169)

Per @edelauna's review: only ENOENT triggers the nearest-ancestor walk-up.
Any other error (e.g. EACCES on a symlink whose target has restricted
permissions) now propagates, and isPathOutsideWorkspace fails closed —
treating the path as outside instead of masking the symlink with the lexical
path. Adds a regression test that stubs realpath to throw EACCES.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: proyectoauraorg

src/utils/__tests__/pathUtils.spec.ts

@@ -72,6 +72,26 @@ describe("isPathOutsideWorkspace", () => {
 		expect(isPathOutsideWorkspace(path.join(linkDir, "deep.txt"))).toBe(true)
 	})
 
+	it("fails closed when symlink resolution throws a non-ENOENT error such as EACCES (#169)", () => {
+		const restricted = path.join(workspaceDir, "restricted.txt")
+		fs.writeFileSync(restricted, "x")
+
+		// Simulate realpath failing with EACCES (e.g. a symlink whose target has
+		// restricted permissions). The path lexically lives inside the workspace, but
+		// an unresolvable symlink must be treated as outside, not silently allowed.
+		const spy = vi.spyOn(fs.realpathSync, "native").mockImplementation(() => {
+			const err: NodeJS.ErrnoException = new Error("permission denied")
+			err.code = "EACCES"
+			throw err
+		})
+
+		try {
+			expect(isPathOutsideWorkspace(restricted)).toBe(true)
+		} finally {
+			spy.mockRestore()
+		}
+	})
+
 	it("returns true when there are no workspace folders", () => {
 		mockWorkspace.folders = []
 		expect(isPathOutsideWorkspace(path.join(workspaceDir, "file.ts"))).toBe(true)

src/utils/pathUtils.ts

@@ -2,13 +2,24 @@ import * as vscode from "vscode"
 import * as path from "path"
 import * as fs from "fs"
 
+/** Narrow an unknown error to a Node errno exception with the given `code`. */
+function isErrnoException(err: unknown, code: string): boolean {
+	return err instanceof Error && (err as NodeJS.ErrnoException).code === code
+}
+
 /**
  * Resolves a path to its canonical form, following symlinks.
  *
  * If the path does not exist yet (e.g. a file that is about to be created), the
  * realpath of the nearest existing ancestor is resolved and the remaining
  * segments are re-appended. This ensures a symlink anywhere along the path is
  * still followed, while paths that don't exist yet can still be evaluated.
+ *
+ * Only `ENOENT` (a not-yet-existing segment) triggers the walk-up. Any other
+ * error — e.g. `EACCES` on a symlink whose target has restricted permissions —
+ * is re-thrown rather than swallowed: silently walking up would mask the symlink
+ * and could let an out-of-workspace target look "inside". Callers performing a
+ * security check are expected to fail closed on a thrown error. See issue #169.
  */
 function realPathOrNearest(target: string): string {
 	let current = path.resolve(target)
@@ -19,7 +30,13 @@ function realPathOrNearest(target: string): string {
 		try {
 			const resolved = fs.realpathSync.native(current)
 			return trailing.length > 0 ? path.join(resolved, ...trailing.reverse()) : resolved
-		} catch {
+		} catch (err) {
+			if (!isErrnoException(err, "ENOENT")) {
+				// Non-ENOENT (e.g. EACCES): don't mask it with a walk-up — propagate so the
+				// caller's security check can fail closed instead of falling through to the
+				// lexical path.
+				throw err
+			}
 			const parent = path.dirname(current)
 			if (parent === current) {
 				// Reached the root without finding an existing path; fall back to the
@@ -47,12 +64,25 @@ export function isPathOutsideWorkspace(filePath: string): boolean {
 	// workspace but points outside it is correctly treated as outside. Without
 	// this, the out-of-workspace read protection was trivially bypassed by
 	// symlinking to a file outside the workspace. See issue #169.
-	const absolutePath = realPathOrNearest(filePath)
+	let absolutePath: string
+	try {
+		absolutePath = realPathOrNearest(filePath)
+	} catch {
+		// Could not safely resolve the target (e.g. EACCES on a symlink). Fail closed:
+		// treat it as outside the workspace rather than risk a false "inside".
+		return true
+	}
 
 	// Check if the path is within any workspace folder
 	return !vscode.workspace.workspaceFolders.some((folder) => {
 		// Resolve the workspace folder too, in case it is itself reached via a symlink.
-		const folderPath = realPathOrNearest(folder.uri.fsPath)
+		let folderPath: string
+		try {
+			folderPath = realPathOrNearest(folder.uri.fsPath)
+		} catch {
+			// Can't resolve this folder safely; it can't be used to prove containment.
+			return false
+		}
 		// Path is inside a workspace if it equals the workspace path or is a subfolder
 		return absolutePath === folderPath || absolutePath.startsWith(folderPath + path.sep)
 	})