$ the-wire · showcase
Bun header encoding corrupts sandboxed responses, and backwards glob ranges stop paths from compiling
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
10 people shipped this
ronleizrowice-ant
@ronleizrowice-ant
4 cited
fallintoplace
@fallintoplace
1 cited
Jasper Hugo
@jbg
KristianGrafana
@KristianGrafana
sehrope
@sehrope
oliverguenther
@oliverguenther
ben-manes
@ben-manes
GitHub Actions (publish-mods)
@actions-user
0xSh1mm3r
@0xSh1mm3r
MuhammadMehroz786
@MuhammadMehroz786
Sandbox-runtime's proxy passes every non-ASCII response header byte through doubled under Bun, while a path entry like [user-id] compiles to no regex and takes the whole sandbox down with it.
Response header bytes past ASCII reach the client unchanged under Bun anthropics/sandbox-runtime
Bun's http.Server writes a response head as a string with no encoding on a connection handed to it via emit('connection'), so the socket's UTF-8 default applies while the proxy reads upstream headers as latin1. Every byte from 0x80 up reaches the client as two, so a redirect's Location, a file's Content-Disposition, and a returned Set-Cookie are all changed in transit.
Read brackets that spell no set of characters as text, so no path entry keeps a sandbox from starting anthropics/sandbox-runtime
A path entry whose brackets hold a backwards range, a folder really named [user-id] or backup[2024-01-15], compiles to no regular expression, and so does an ordinary relative pattern such as **/.env when the working directory sits inside such a folder. Every wrap then throws, and no command can be sandboxed.
linux: bind a write deny that holds an allowed write path anthropics/sandbox-runtime
denyWrite now takes precedence over allowWrite however the two are nested on Linux; previously a deny holding an allowed write path produced no read-only bind at all. A deny path that only write paths beneath a deny directory would hold gets no mount point, since nothing can create it there.
windows: deny entries rank as on the other platforms anthropics/sandbox-runtime
On Windows, filesystem lists and credentials.files become ACEs for the sandbox account and are now ranked against each other before srt-win is called, matching the other platforms. An allowWrite at or beneath a denyWrite path grants read and execute only, and the trust bundle is the sole exception to credentials.files winning.
json: serialize recursive WKT views directly anthropics/buffa
StructView, ValueView, and ListValueView now serialize directly, walking borrowed fields instead of copying nested data into owned messages before JSON encoding. A Criterion benchmark for a nested Struct puts the change at 614 µs to 249 µs, 59% faster across 20 samples.
