From 720df98a5a0ef1dea78abcd92c52ea468c4e5b06 Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Mon, 9 Nov 2026 21:16:43 +0000 Subject: [PATCH] Mark native overlay remediation complete --- docs/roadmap/remediation.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md index 299348f..5d0a2f8 100644 --- a/docs/roadmap/remediation.md +++ b/docs/roadmap/remediation.md @@ -17,6 +17,8 @@ against the [implementation plan](implementation.md) and ## Finding 1 — Native overlay symlinks bypass containment and duplicate checks +**Status** — Complete. Native overlay lookup resolves supported symlinks before containment and repeat checks. The overlay tests cover escapes, aliases in both directions, and a contained target. + **Priority P2.** The layered branch passes the inherited root and lookup base to the shared overlay loader. That loader calls `filesystemAccess.canonical`. For a native filesystem, the function stats the path and returns its lexical