Get rid of ~/src folder and paste file mounts directly in homedir/sky_workdir#1441
Get rid of ~/src folder and paste file mounts directly in homedir/sky_workdir#1441
Conversation
Paragon SummaryThis pull request review identified 2 issues across 2 categories in 3 files. The review analyzed code changes, potential bugs, security vulnerabilities, performance issues, and code quality concerns using automated analysis tools. This PR eliminates the intermediate Key changes:
Confidence score: 3/5
3 files reviewed, 2 comments Severity breakdown: High: 1, Medium: 1 Tip: |
![paragon-review[bot]](https://avatars.githubusercontent.com/in/1544258?s=60&v=4){kind=small}
| return | ||
| dest_dir = os.path.expanduser("~/src") | ||
| os.makedirs(dest_dir, exist_ok=True) | ||
| home_dir = os.path.expanduser("~") |
There was a problem hiding this comment.
Bug: Fallback dest_dir resolves to bare home directory
Fallback dest_dir resolves to bare home directory. Task files may overwrite dotfiles like .bashrc or .ssh keys. Use a dedicated subdirectory instead.
View Details
Location: lab-sdk/src/lab/lab_facade.py (lines 294)
Analysis
**Fallback dest_dir resolves to bare home directory. Task files may overwrite dotfiles like **
| What fails | When |
| Result | User dotfiles are silently overwritten with task content, potentially destroying SSH keys, shell configs, or credentials. |
| Expected | Files should be copied to a dedicated subdirectory (e.g., ~/tfl_workdir) that is created if missing, never directly into ~. |
| Impact | Data loss and environment corruption. A malicious or misconfigured task could destroy SSH keys or credentials. On shared machines this is a privilege-escalation vector. |
How to reproduce
1. Ensure ~/sky_workdir does not exist
2. Run a job that triggers copy_file_mounts
3. Include a task file named .bashrc or .gitconfig
4. Observe it overwrites the real dotfile in ~Patch Details
- dest_dir = home_dir
+ dest_dir = os.path.join(home_dir, "tfl_workdir")
+ os.makedirs(dest_dir, exist_ok=True)AI Fix Prompt
Fix this issue: Fallback dest_dir resolves to bare home directory. Task files may overwrite dotfiles like .bashrc or .ssh keys. Use a dedicated subdirectory instead.
Location: lab-sdk/src/lab/lab_facade.py (lines 294)
Problem: When ~/sky_workdir doesn't exist, dest_dir falls back to the bare home directory (~). Task files copied there can silently overwrite user dotfiles (.bashrc, .profile, .ssh/authorized_keys).
Current behavior: User dotfiles are silently overwritten with task content, potentially destroying SSH keys, shell configs, or credentials.
Expected: Files should be copied to a dedicated subdirectory (e.g., ~/tfl_workdir) that is created if missing, never directly into ~.
Steps to reproduce: 1. Ensure ~/sky_workdir does not exist
2. Run a job that triggers copy_file_mounts
3. Include a task file named .bashrc or .gitconfig
4. Observe it overwrites the real dotfile in ~
Provide a code fix.
Tip: Reply with @paragon-run to automatically fix this issue
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
2 participants
No description provided.