How to use Claude to contain remote pull paths
Claude repaired remote pull path handling in a Rust client, testing actual binary behavior against a mock API while documenting symlink and race limits.
github.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Audit every remote-name-to-local-path operation in this Rust client, including pull, ZIP folders, and sync deletion. Reject multi-component names and existing symlink escapes. Test the real binary against a mock API with outside-directory snapshots and mutation checks. Document TOCTOU and overwrite risks before proposing a merge.
Reach people exploring AI agents
See placements →What happened
The merged client patch rejects unsafe remote path components and existing symlink escapes across pull, ZIP, and sync-delete operations, with documented residual risks.
Reported by guuslangelaar0 — GitHubHow the agent did it
- Claude added a common Rust safe-path function for remote names entering local filesystem operations.
- Tests ran the actual bb binary against a mock API and checked for writes outside a scratch destination.
- A follow-up validated the top-level ZIP folder, and the author merged the passing patch.
Where a person stepped in
guuslangelaar0 retained merge control; Codex review comments prompted an additional ZIP-folder guard. Production-server validation and unresolved filesystem races are explicitly outside this evidence.
A remote upload name in the bb command-line client could become an unchecked local filesystem path. Claude Code produced a Rust repair that applied a shared safe-path routine to pull, ZIP extraction, and synchronization deletion paths.
The guard required a remote name to represent one path component, checked containment against the deepest existing ancestor, and rejected existing symlinks instead of following them. Explicit user-selected output paths remained a separate behavior. A follow-up change validated the top-level ZIP folder after review comments from Codex.
The verification exercised the real bb binary against an in-process mock API. Scratch directories and outside-directory snapshots showed whether an attempted escape wrote somewhere it should not. The account records failing cases before the repair, repeated passing runs afterward, mutation checks, and Cargo, formatting, and lint checks. The author merged the patch into main.
The PR also documents remaining boundaries. Its tests used a mock service, rather than production infrastructure. A check-then-write race was not eliminated, and ordinary pulls could still overwrite an existing file. That makes this a concrete containment improvement with named residual risks, rather than a claim that all filesystem handling became safe.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: GitHub · guuslangelaar0
Frequently asked questions
Did testing use the production server?
No. It used the actual client binary and a mock API.
Why inspect existing ancestors?
Containment checks must account for existing filesystem paths and symlinks.
Does this close every filesystem race?
No. The PR explicitly leaves the check-then-write race unresolved.
More details
About this account
Claude added a common Rust safe-path function for remote names entering local filesystem operations. Tests ran the actual bb binary against a mock API and checked for writes outside a scratch destination.
Original PR explicitly credits Claude Code, with Codex review comments. The public API supplies publication and merge times. Mock-API results do not demonstrate production behavior or removal of the acknowledged race. Suggested prompt written by Agents In Use; no original task prompt was published in the verified account.
Credit: guuslangelaar0 — GitHub
Source published 4 Oct 2026
Source checked 14 Oct 2026
Tools and topics
Claude Code · Rust · Cargo · mock API
path traversal · symlinks · mutation testing
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.