zerone0x 376a52a5ba fix: use 0o644 for inbound media files to allow sandbox read access (#17943) ...

* fix: use 0o644 for inbound media files to allow sandbox read access

Inbound media files were saved with 0o600 permissions, making them
unreadable from Docker sandbox containers running as different users.

Change to 0o644 (world-readable) so sandboxed agents can access
downloaded attachments.

Fixes #17941

Co-Authored-By: Claude <noreply@anthropic.com>

* test(media): assert URL-sourced inbound files use 0o644

* test(media): make redirect file-mode assertion platform-aware

* docs(media): clarify 0o644 is for sandbox UID compatibility

---------

Co-authored-by: zerone0x <zerone0x@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

2026-03-01 22:14:39 -08:00

..

audio-tags.ts

refactor: unify inline directives and media fetch

2026-01-10 03:01:04 +01:00

audio.test.ts

refactor(media): centralize voice compatibility policy

2026-02-14 03:17:40 +01:00

audio.ts

refactor(media): centralize voice compatibility policy

2026-02-14 03:17:40 +01:00

base64.test.ts

fix(security): harden session export image data-url handling

2026-02-24 02:53:39 +00:00

base64.ts

fix(security): harden session export image data-url handling

2026-02-24 02:53:39 +00:00

constants.ts

fix(media): classify text/* MIME types as documents (openclaw#12341) thanks @arosstale

2026-02-13 18:38:38 -06:00

fetch.test.ts

chore: Fix types in tests 37/N.

2026-02-17 15:50:07 +09:00

fetch.ts

Mattermost: avoid raw fetch in monitor media download

2026-02-26 16:03:39 +00:00

host.test.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

host.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

image-ops.helpers.test.ts

refactor(media): share image resize side grid and quality steps

2026-02-18 18:25:25 +00:00

image-ops.ts

refactor(media): share image resize side grid and quality steps

2026-02-18 18:25:25 +00:00

inbound-path-policy.test.ts

fix: enforce inbound attachment root policy across pipelines

2026-02-19 14:15:51 +01:00

inbound-path-policy.ts

fix: enforce inbound attachment root policy across pipelines

2026-02-19 14:15:51 +01:00

input-files.fetch-guard.test.ts

fix(security): harden session export image data-url handling

2026-02-24 02:53:39 +00:00

input-files.ts

fix(security): harden session export image data-url handling

2026-02-24 02:53:39 +00:00

load-options.test.ts

refactor: split telegram delivery and unify media/frontmatter/i18n pipelines

2026-03-02 04:14:06 +00:00

load-options.ts

refactor: split telegram delivery and unify media/frontmatter/i18n pipelines

2026-03-02 04:14:06 +00:00

local-roots.ts

refactor(tmp): harden temp boundary guardrails

2026-02-24 23:51:10 +00:00

mime.test.ts

fix(media): serve JavaScript assets with text/javascript

2026-02-27 12:16:36 +05:30

mime.ts

fix(media): serve JavaScript assets with text/javascript

2026-02-27 12:16:36 +05:30

outbound-attachment.ts

refactor: split telegram delivery and unify media/frontmatter/i18n pipelines

2026-03-02 04:14:06 +00:00

parse.test.ts

test: optimize gateway infra memory and security coverage

2026-02-21 21:44:50 +00:00

parse.ts

fix(media): strip MEDIA: lines with local paths instead of leaking as text (#14399)

2026-02-12 07:45:22 -06:00

png-encode.ts

refactor: consolidate PNG encoder and safeParseJson utilities (#12457)

2026-02-09 00:21:54 -08:00

read-response-with-limit.ts

refactor(media): share response size limiter

2026-02-15 05:01:11 +00:00

server.outside-workspace.test.ts

fix: harden sandbox media reads against TOCTOU escapes

2026-03-02 01:04:01 +00:00

server.test.ts

test(media): dedupe server fixture helpers and cover 404/id validation

2026-02-21 21:40:39 +00:00

server.ts

fix: harden sandbox media reads against TOCTOU escapes

2026-03-02 01:04:01 +00:00

sniff-mime-from-base64.ts

refactor(media): share base64 mime sniff helper

2026-02-15 04:17:44 +00:00

store.outside-workspace.test.ts

test: add outside-workspace error mapping coverage

2026-02-28 18:08:10 +05:30

store.redirect.test.ts

fix: use 0o644 for inbound media files to allow sandbox read access (#17943)

2026-03-01 22:14:39 -08:00

store.test.ts

test: share temp home env harness

2026-02-19 15:08:14 +00:00

store.ts

fix: use 0o644 for inbound media files to allow sandbox read access (#17943)

2026-03-01 22:14:39 -08:00