{"version":"2.1.247","anchor":"sandbox-deny-rules-follow-every-hop-of-a-symlinked-path","canonical_anchor":"sandbox-deny-rules-follow-every-hop-of-a-symlinked-path","heading":"Sandbox deny rules follow every hop of a symlinked path","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247\/e\/sandbox-deny-rules-follow-every-hop-of-a-symlinked-path","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.247","markdown":"### Sandbox deny rules follow every hop of a symlinked path\n\nSandbox deny rules now block every directory a symlink chain passes through, not just the endpoint.\n\n**What**\n\nWhen a denied path is a symlink chain, the sandbox now denies the directories crossed along the way, not just the final target. Applies to everyone; on Windows no hop set is computed.\n\n**Details**\n\n- The walk is capped by a hop budget and stops on anything other than the expected missing-or-not-a-directory errors.\n- A new resolver handles dangling paths before the old parent-directory fallback.\n\n**Evidence**\n\n`hopDirectories`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}