Use it now
Useful3 Signal4
Artifact asset uploads re-verify the file after approval, refusing symlinks and swaps, behind an env var.
What's wrong with this entry?
Anonymous. No account, no email.
CLAUDE_CODE_ARTIFACT_ASSETS
What
Before an approved upload is read, the path is re-resolved and opened refusing symlinks, then re-checked against the identity recorded at approval, so a file cannot be substituted after you approve it. Available only where asset actions are enabled by CLAUDE_CODE_ARTIFACT_ASSETS.
Details
- The file is re-stated through the open handle and its device, inode, size and nanosecond mtime compared with the approved values, with a further check of the open file's own path entry.
- Separate refusals cover network paths, non-regular files, empty files, volumes with no usable inode identity, files reached through a symlink, and files with more than one hard link.
- Read permission rules are evaluated on the resolved path, so a symlink cannot be used to send out a file you have denied.
Evidence
upload_asset reads only local files
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.246
upload_asset parameter now lists text formats
Both mention asset