Struct SymlinkAwareSandbox 

pub struct SymlinkAwareSandbox { /* private fields */ }

Sandbox that follows symlinks in the root directory.

Like FsSandbox, but also allows access to targets of symlinks found directly under the root. This is designed for package managers (e.g. npm link / alc_pkg_link) where the root directory contains symlinks pointing to external source directories.

How it works

At construction time, scans the root for symlink entries and records their canonical targets as additional allowed roots. During read(), a file is permitted if its canonical path is under the root or under any of the recorded symlink targets.

Security boundary

Same as FsSandbox: casual escape prevention for trusted directories. The allowed target set is fixed at construction time; symlinks added after construction are not recognized until a new instance is created.

Implementations

impl SymlinkAwareSandbox

pub fn new(root: impl Into<PathBuf>) -> Result<Self, InitError>

Trait Implementations

impl SandboxedFs for SymlinkAwareSandbox

fn read(&self, relative: &Path) -> Result<Option<FileContent>, ReadError>

Read a file by relative path.