{"version":"2.1.265","anchor":"sandboxpath-escape-check-now-rejects-backslash-paths-and-ve","canonical_anchor":"sandboxpath-escape-check-now-rejects-backslash-paths-and-ve","heading":"Sandbox path-escape check now rejects backslash paths and verifies file identity by inode","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.265\/e\/sandboxpath-escape-check-now-rejects-backslash-paths-and-ve","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.265","markdown":"### Sandbox path-escape check now rejects backslash paths and verifies file identity by inode\n\nThe sandbox boundary check now blocks backslash paths and uses a new statBigint helper to catch files swapped after path resolution\n\n**What**\n\n- The filesystem abstraction gained a `statBigint` method alongside the existing `lstatBigint`, for stat calls that follow symlinks with bigint precision.\n\n- The directory-boundary escape check used for sandboxing now explicitly rejects any path containing a backslash, since backslashes make path resolution unreliable.\n\n- After `realpath` succeeds, the check now also compares the `dev`\/`ino` (device\/inode) values, via the new `statBigint`, between the original path and its resolved target before declaring it \"inside\" the sandbox boundary \u2014 catching the case where the file was swapped out between resolution and access.\n\n**Why** This closes a gap where a maliciously crafted or swapped path could appear to resolve inside the sandbox boundary but actually point somewhere else by the time it's accessed; checking file identity by inode, not just by resolved path string, makes the boundary check harder to trick.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}