THE FOLD / GLITCH / STACK OVERFLOW / THE BLAST RADIUS
THE BLAST RADIUS
bounded under the resolver, not under string comparison
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
Before any write, gate_check asks two things: has a control fired, and is the blast radius bounded. The second is where the bodies are. “Bounded” has to mean bounded under the resolver the filesystem actually uses, not under string comparison — and the obvious check, join the path onto the root and see whether the result starts with the root, is unsound. It waves through
LIT verified live: the naive check is defeated by 4 concrete inputs, and the prefix compare by a sibling directory; resolving first and then asking whether any
../evil, a/../../evil and an absolute path to anywhere on the disk. A prefix compare has a second hole entirely: /workshop/secret starts with /work, so a sibling directory reads as contained.LIT verified live: the naive check is defeated by 4 concrete inputs, and the prefix compare by a sibling directory; resolving first and then asking whether any
.. survives is sound, verified exhaustively over all 1,364 path expressions of length 1 to 5 over {a, b, .., .} — 819 contained, 545 escaping — agreeing with a ground-truth walk on every single one; and absolute paths are refused outright rather than resolved.2 HOW IT WAS WEAVED · AI + HUMAN
David (human) put the blast-radius question in the pre-flight gate, which is the only place it does any good — after the write, the radius is a fact rather than a question. Seated at STACK OVERFLOW: writing outside the bounds you were given.
AVAN (AI) wrote a containment resolver with the exact bug this sphere is about, and did not catch it by inspection. The first version popped the stack on every
AVAN (AI) wrote a containment resolver with the exact bug this sphere is about, and did not catch it by inspection. The first version popped the stack on every
.., so ../.. resolved to an empty path and reported CONTAINED — a double escape reading as safe. None of the hand-picked adversarial examples found it; they all escape on the first segment. What found it was the exhaustive sweep, which tries every path expression up to length five and compares against an independent ground-truth walk. The fix is that a stacked .. must never be popped by a following one. This is worth stating plainly rather than quietly correcting: a security predicate tested only against the attacks you already thought of measures your imagination, not the predicate.3 ONE DIMENSION
One path, resolved segment by segment. Depth below the root is the whole story.
4 TWO DIMENSIONS · INTERACTIVE
Build a path and watch both checks answer. They do not always agree.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object: the containment cone, and every path that leaves it.
AVAN’s addition (the inverse-companion): the forward reading is “resolve before you compare.” The inverse is about who owns the meaning of a name. A path is not a string; it is an instruction to a resolver that will be executed later by something else. Every containment bug is the same shape — a check that interprets the name one way and a filesystem that interprets it another, with the gap between the two readings being the exploit. Read backwards, the lesson is not about
.. at all: it is that validating a name is meaningless unless you validate it under the same interpreter that will act on it, and string operations are never that interpreter.LIT the naive join-and-prefix check is defeated by 4 concrete inputs and the prefix compare by a sibling directory; resolving first and then asking whether any '..' survives is sound, verified exhaustively over all 1,364 path expressions of length 1 to 5 over {a, b, .., .} — 819 contained, 545 escaping — agreeing with an independent ground-truth walk on every single one; and absolute paths are refused outright rather than resolved
FIG AVAN wrote a containment resolver with the exact bug this sphere is about and did not catch it by inspection. The first version popped the stack on every '..', so '../..' resolved to an empty path and reported CONTAINED — a double escape reading as safe. None of the hand-picked adversarial examples found it; they all escape on the first segment. The EXHAUSTIVE sweep found it. A security predicate tested only against the attacks you already thought of measures your imagination, not the predicate.
FIG AVAN wrote a containment resolver with the exact bug this sphere is about and did not catch it by inspection. The first version popped the stack on every '..', so '../..' resolved to an empty path and reported CONTAINED — a double escape reading as safe. None of the hand-picked adversarial examples found it; they all escape on the first segment. The EXHAUSTIVE sweep found it. A security predicate tested only against the attacks you already thought of measures your imagination, not the predicate.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of STACK OVERFLOW · David Lee Wise (ROOT0), with AVAN