FUNCTION DISPATCH · PATH CONTAINMENT
Function dispatch: inspect a validated file operation
Follow one model-proposed file path through joining, normalisation and symbolic-link resolution, and see which containment check stops it.
Your experiment
The model asks the file tool to read ../etc/passwd. The tool joins it to /workspace and checks that the string starts with /workspace, so the check passes and the tool reads a file outside the sandbox. Try the stronger checks, then the sibling directory and the symbolic link.
Play replays the computed run over sixty inspection seconds; Next event steps, Restart rewinds, and Inspection time scrubs. Any input change recomputes the run and rewinds it without autoplay.
Event trace
Computed data
Final metrics
Fictional file system: the sandbox root is /workspace, /workspace/link-out is a symbolic link to /etc, and /etc/passwd holds a fictional line of text. Normalisation and link resolution are implemented here in a few lines for one link; no real file system, java.nio or ADK tool is used. Real guards must also handle races between check and use, hard links, case-insensitive file systems and Windows paths.
A path argument is untrusted input
A file tool exposed to a model receives its path from the model, and the model may have read a prompt-injected document. Before dispatch the tool must prove the path stays inside its sandbox root, here /workspace. That takes three steps: join a relative argument to the root, normalise away "." and ".." segments, and resolve symbolic links to the real target. Containment check before dispatch decides which of those results the tool tests. The fixture file system also contains /etc/passwd (fictional text), a sibling directory /workspace-archive and a link /workspace/link-out pointing to /etc.
The opening run: a string check passes ../
The model calls file_op with op read and path ../etc/passwd, the opening Path argument proposed by the model. Joined to the root it becomes /workspace/../etc/passwd. The check String starts with /workspace looks at that raw string and accepts it, but normalisation shows the real target is /etc/passwd, outside the root, and the tool returns its contents: a sandbox escape. The table applies the same check to all six fixture paths: under the string check four of them escape, ../etc/passwd, /workspace/../etc/passwd, /workspace-archive/old.txt (the prefix /workspace also matches /workspace-archive) and link-out/passwd.
Failure boundary: normalising is not enough
Choose Normalized path inside /workspace/: ../ paths normalise to /etc/passwd and are rejected, and requiring the trailing slash rejects /workspace-archive. One escape remains: link-out/passwd normalises to /workspace/link-out/passwd, which looks inside, but the link makes its real target /etc/passwd. Only Normalized, links resolved, inside /workspace/ rejects all four and leaves zero escapes in the table. Benign paths still work under every check: notes/./../report.txt resolves to /workspace/report.txt and notes/tasks.md stays where it is.
Operation and write permission
Operation chooses read, write or delete. With Tool may write and delete off, write and delete are refused after the containment check, so an escaping path does no harm, but the trace still notes that containment alone would have let it out. Turn the permission on with the string check and a write to ../etc/passwd overwrites /etc/passwd: the same escape is now a modification instead of a disclosure. With the strongest check, deleting notes/tasks.md is allowed and stays inside the sandbox. Permission and containment are separate controls, and both are needed.
Reading the run and its limits
Play replays the call, the join, normalisation, link resolution, the containment decision, execution and the outcome over sixty inspection seconds; Next event, Restart, Speed and Inspection time control the replay, and any input change recomputes it. The table shows, for every fixture path, the path the selected check examines, its real target and whether it escapes. The file system is a fixture with one link and four files. Real guards also face check-then-use races, hard links, case-insensitive and Windows paths, and should use the platform’s real-path API rather than string handling, as the linked articles explain.