[Security] workspace-write fs fence silently grants <drive>:\tmp as a writable root on Windows

[maycuatroi1]

Security report: workspace-write fs fence silently grants <drive>:\tmp as a writable root on Windows

Researcher: Binhna. Defensive research, all validation local with minimal-impact marker writes.

Summary

writableRoots() (packages/sandbox/sandbox/src/roots.ts:52-55 at commit 47f9438, the current master HEAD) unconditionally includes the POSIX literal '/tmp' in the workspace-write allow-list:

return [...new Set([policy.workspaceRoot, '/tmp', tmpdir()].map(canonicalPath))]

On Windows, realpathSync.native('/tmp') resolves a drive-rooted path against the process's current drive. When <drive>:\tmp exists (installers and users create it; C:\tmp pre-existed on my validation host), canonicalPath returns C:\tmp, and the in-process fs fence (SandboxedFileSystem.checkedTarget, packages/fs/fs-sandbox/src/index.ts:126-148) admits any target under it. The fs / str_replace_editor write tools can then write anywhere under C:\tmp with no approval, outside the workspace and outside the per-user %TEMP% the mode documents.

Notably C:\tmp on default installs is modifiable by all Authenticated Users, so this is a machine-shared, cross-user-visible staging area - and the ACL sandbox denies writes there from confined shell commands, so the two write planes disagree on the same path.

Reproduction (validated on Windows 11, build 26200)

Called the repository's own writableRoots and isPathUnder directly from source, with policy { mode: 'workspace-write', workspaceRoot: <poc-workspace> }:

writableRoots : [
  "C:\\...\\poc-workspace",
  "C:\\tmp",
  "C:\\Users\\<user>\\AppData\\Local\\Temp"
]
probe C:\tmp\dropped-by-fs-tool.txt  -> fence verdict: ALLOWED   (via the C:\tmp root)
probe C:\Users\<user>\outside.txt    -> fence verdict: DENIED    (control)

Precondition: C:\tmp exists (recorded pre-existing on the host; not created for the test). While the directory is absent the literal stays inert, so the widening is silent and environment-dependent.

Impact

• Any Windows session in workspace-write (the default preset) on a machine where <cwd-drive>:\tmp exists.
• The model (or a prompt-injected turn) gains an approval-free, persistent write area outside the workspace; files survive session cleanup, stay out of git status, and are shared with other local users. If C:\tmp is on PATH (common for users who create it for scratch scripts), planted executables shadow commands in the user's normal shell.
• Severity view: low/medium - it is a widened write grant, not a sandbox escape by itself (shell writes there are still denied; reads are unrestricted by design elsewhere).

Suggested fix

Gate the host-temp literal to POSIX platforms in writableRoots (Windows keeps exactly {workspaceRoot, os.tmpdir()}), with a deterministic cross-platform test that mocks os.tmpdir() so the two temp roots stay distinguishable. A ready branch with the fix, tests, and an Agent Note (following repo conventions, all local gates run: vitest roots/fs-sandbox, note-format/classification, md-wrap/md-links, translation-pairing, tsc -b, pre-push typecheck):

https://github.com/maycuatroi1/deepseek-harness/tree/fix/win32-tmp-literal-writable-root

Filed as a discussion per CONTRIBUTING.md (external PRs not accepted at the moment); happy to rework or hand the patch over in whatever form is easiest for maintainers.

Context from the same review (defended surfaces, negative results)

For completeness, the same validation run confirmed the Windows ACL restricted-token sandbox fails closed against direct out-of-workspace writes, WSL interop (Wsl/Service/CreateInstance/E_ACCESSDENIED, cold and warm distro), \\wsl.localhost UNC access, and the Docker Desktop engine named pipe - all under workspace-write on the same host.

[guntur-d]

Thanks for the detailed security report — confirmed. Fixed in the guntur-d/deepseek-harness fork (PR #7): writableRoots() now drops the POSIX /tmp literal on win32 entirely (os.tmpdir() already carries the Windows temp area), with an injectable platform name so the cross-platform behavior is pinned by test. All enforcement dialects derive from the same function, so the fence and the native profiles cannot drift.

[guntur-d]

感谢详细的安全报告，已确认。已在 guntur-d/deepseek-harness fork 修复（PR #7）：writableRoots() 在 win32 上完全去掉 POSIX /tmp 字面量（os.tmpdir() 已覆盖 Windows 临时目录），并支持注入平台名以便跨平台测试钉住行为。所有执行方言都从同一函数推导，围栏与原生配置不会漂移。