viyatb-oai ccde2fc8b7
Protect ripgrep lookup during Linux sandbox construction ( #51407 ) ...
## Why
Deny-read glob expansion runs before sandbox confinement. Resolving `rg` directly from `PATH` could execute a writable workspace binary at that stage.
## What changed
Use the existing protected executable lookup to select a canonical `rg` path under the filesystem policy. Fall back to the native glob walker when no suitable executable is found, preserving masks for matching denied paths.
## Testing
Extend denied-file integration tests to verify that a writable workspace `rg` never runs, a protected `rg` is used when available, and denied files remain blocked with the native fallback.
GitOrigin-RevId: f06674f3535c8a72a4656871762e45fa13c732f2
2026-10-06 16:30:34 +00:00
2026-10-02 04:02:14 +00:00
2026-09-29 22:50:07 +00:00
2026-09-30 17:33:59 +00:00
2026-10-06 10:49:44 +00:00
2026-09-30 00:51:39 +00:00
2026-10-06 15:50:27 +00:00
2026-09-26 23:17:41 +00:00
2026-10-04 06:28:20 +00:00
2026-10-06 15:50:27 +00:00
2026-09-22 06:36:09 +00:00
2026-10-05 22:38:32 +00:00
2026-10-05 23:52:06 +00:00
2026-10-05 23:52:06 +00:00
2026-09-18 00:25:37 +00:00
2026-09-21 22:58:49 +00:00
2026-09-23 00:47:34 +00:00
2026-10-02 22:20:55 +00:00
2026-09-30 18:49:29 +00:00
2026-10-06 00:58:19 +00:00
2026-10-01 22:32:29 +00:00
2026-09-29 13:58:09 +00:00
2026-09-29 03:32:19 +00:00
2026-10-05 22:18:55 +00:00
2026-10-05 22:18:55 +00:00
2026-10-06 00:36:25 +00:00
2026-10-05 16:58:29 +00:00
2026-10-06 14:42:57 +00:00
2026-09-25 00:20:02 +00:00
2026-09-24 01:50:36 +00:00
2026-09-14 19:12:59 +00:00
2026-10-06 01:17:03 +00:00
2026-10-06 03:35:55 +00:00
2026-09-15 18:23:08 +00:00
2026-10-02 22:12:07 +00:00
2026-10-06 15:50:27 +00:00
2026-10-06 01:39:50 +00:00
2026-09-23 22:20:34 +00:00
2026-10-01 15:57:03 +00:00
2026-10-06 00:58:19 +00:00
2026-10-06 12:10:58 +00:00
2026-10-02 04:25:52 +00:00
2026-10-06 15:43:56 +00:00
2026-10-06 15:50:27 +00:00
2026-10-06 03:35:55 +00:00
2026-10-02 22:47:52 +00:00
2026-10-01 09:52:54 +00:00
2026-10-01 00:43:55 +00:00
2026-10-01 15:57:03 +00:00
2026-10-06 03:27:04 +00:00
2026-10-06 15:50:27 +00:00
2026-10-01 11:01:37 +00:00
2026-10-01 22:32:29 +00:00
2026-09-11 21:59:24 +00:00
2026-09-29 22:24:09 +00:00
2026-10-06 16:30:34 +00:00
2026-10-02 23:26:27 +00:00
2026-09-28 14:46:32 +00:00
2026-09-28 06:30:53 +00:00
2026-10-03 00:31:51 +00:00
2026-10-02 23:26:27 +00:00
2026-10-06 01:46:33 +00:00
2026-10-01 18:05:05 +00:00
2026-10-01 18:05:05 +00:00
2026-10-06 12:32:27 +00:00
2026-09-23 22:20:34 +00:00
2026-10-06 10:39:16 +00:00
2026-10-06 15:50:27 +00:00
2026-10-01 15:57:03 +00:00
2026-09-29 01:14:41 +00:00
2026-10-02 23:54:32 +00:00
2026-10-06 15:50:27 +00:00
2026-10-06 03:58:55 +00:00
2026-10-06 00:58:19 +00:00
2026-09-24 18:08:31 +00:00
2026-09-28 15:58:17 +00:00
2026-09-27 03:26:57 +00:00
2026-10-06 02:14:22 +00:00
2026-10-02 00:46:14 +00:00
2026-10-04 04:25:31 +00:00
2026-10-06 15:50:27 +00:00
2026-10-06 00:36:25 +00:00
2026-10-06 15:50:27 +00:00
2026-10-01 18:05:05 +00:00
2026-10-03 07:14:12 +00:00
2026-10-01 15:57:03 +00:00
2026-09-23 04:25:28 +00:00
2026-09-22 23:37:39 +00:00
2026-10-06 03:43:22 +00:00
2026-10-03 03:20:37 +00:00
2026-09-23 00:47:07 +00:00
2026-10-01 15:57:03 +00:00
2026-10-06 14:42:57 +00:00
2026-10-03 21:20:56 +00:00
2026-10-02 04:02:14 +00:00
viyatb-oai
ccde2fc8b7