clone/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-04-24 06:35:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fail closed for invalid managed profile security keys

Browse Source
This commit is contained in:
Eva Wong
2026-03-18 12:31:39 -07:00
parent a0f95b69b8
commit 064bcae60e
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
codex-rs/core/src/config_loader/macos.rs
View File

@@ -194,7 +194,7 @@ fn parse_managed_config_base64(encoded: &str) -> io::Result<Option<ManagedAdminC
fn is_invalid_security_managed_config_entry(dropped_entry: &str) -> bool {
matches!(
managed_entry_top_level_key(dropped_entry),
managed_entry_leaf_key(dropped_entry),
"approval_policy" | "sandbox_mode"
)
}
@@ -261,11 +261,22 @@ fn is_invalid_security_managed_requirements_entry(dropped_entry: &str) -> bool {
}
fn managed_entry_top_level_key(dropped_entry: &str) -> &str {
let path = managed_entry_path(dropped_entry);
path.split(['.', '[']).next().unwrap_or(path)
}
fn managed_entry_leaf_key(dropped_entry: &str) -> &str {
let path = managed_entry_path(dropped_entry);
let leaf = path.rsplit('.').next().unwrap_or(path);
leaf.split('[').next().unwrap_or(leaf)
}
fn managed_entry_path(dropped_entry: &str) -> &str {
let path = dropped_entry
.split_once(':')
.map_or(dropped_entry, |(path, _)| path)
.trim();
path.split(['.', '[']).next().unwrap_or(path)
path
}
fn decode_managed_preferences_base64(encoded: &str) -> io::Result<String> {

8
codex-rs/core/src/config_loader/tests.rs
View File

@@ -482,6 +482,14 @@ async fn managed_preferences_invalid_security_config_entry_fails_closed() -> any
"sandbox_mode = \"bogus\"\nmodel = \"managed\"\n",
"sandbox_mode",
),
(
"[profiles.team]\napproval_policy = \"bogus\"\n",
"profiles.team.approval_policy",
),
(
"[profiles.team]\nsandbox_mode = \"bogus\"\n",
"profiles.team.sandbox_mode",
),
] {
let tmp = tempdir()?;
let err = load_config_layers_state(