{"record":{"id":"4fe068c1bae2bdb7","repo":"jdx/mise","slug":"cask-uses-feature-which-mise-s-cask-shim-doe","errorCode":null,"errorMessage":"cask uses `#{feature}`, which mise's cask shim does not support","messagePattern":"cask uses `#(.+?)`, which mise's cask shim does not support","errorType":"exception","errorClass":"ShimUnsupportedError","httpStatus":null,"severity":"error","filePath":"src/system/packages/brew/cask_shim.rb","lineNumber":51,"sourceCode":"end\n\nMISE_BREW_CASK_FILE = Pathname.new(ENV.fetch(\"MISE_BREW_CASK_FILE\"))\nMISE_BREW_CASK_TOKEN = ENV.fetch(\"MISE_BREW_CASK_TOKEN\")\nMISE_BREW_CASK_VERSION = ENV.fetch(\"MISE_BREW_CASK_VERSION\")\nMISE_BREW_CASK_STAGED_PATH = Pathname.new(ENV.fetch(\"MISE_BREW_CASK_STAGED_PATH\"))\nMISE_BREW_CASK_APPDIR = Pathname.new(ENV.fetch(\"MISE_BREW_CASK_APPDIR\"))\nMISE_BREW_PREFIX = Pathname.new(ENV.fetch(\"MISE_BREW_PREFIX\"))\nMISE_BREW_CASK_HOOK = ENV.fetch(\"MISE_BREW_CASK_HOOK\")\n\ndef odie(message)\n  $stderr.puts \"Error: #{message}\"\n  exit 1\nend\n\nclass ShimUnsupportedError < StandardError; end\n\ndef shim_unsupported!(feature)\n  raise ShimUnsupportedError,\n        \"cask uses `#{feature}`, which mise's cask shim does not support\"\nend\n\nmodule OS\n  def self.mac?\n    RbConfig::CONFIG[\"host_os\"].include?(\"darwin\")\n  end\n\n  def self.linux?\n    RbConfig::CONFIG[\"host_os\"].include?(\"linux\")\n  end\nend\n\nclass MacOSVersion\n  include Comparable\n\n  SYMBOLS = {\n    tahoe: \"26\", sequoia: \"15\", sonoma: \"14\", ventura: \"13\",","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/packages/brew/cask_shim.rb#L33-L69","documentation":"After resolving a remote task's Git checkout, mise validates that the requested path (including symlink resolution via canonicalize) still lies inside the checkout root. If the canonicalized path escapes the checkout — e.g. through a symlink pointing outside — mise refuses to read it, preventing a remote task from pulling in arbitrary local files.","triggerScenarios":"Installing/resolving a remote task (remote_task_git provider) where the requested sub-path resolves (via symlink or `..` traversal after canonicalization) outside the cloned repository; validate_remote_git_path is called from resolve_git_url_to_path and prepare_remote_path.","commonSituations":"A remote task URL pointing at a path that is a symlink to another location; a malicious or misconfigured remote task repository containing symlinks out of the checkout; typos in the in-repo path combined with a symlink named similarly.","solutions":["Fix the remote task URL to point at a real path inside the repository (not a symlink escaping it).","Remove or replace out-of-tree symlinks in the remote task repository.","If you need files from another repo, reference that repo as its own remote task source."],"exampleFix":"// before\ntasks = [\"github:org/repo#/tasks/link-to-etc-passwd\"]\n\n// after\ntasks = [\"github:org/repo#/tasks/build.sh\"]","handlingStrategy":"validation","validationCode":"// Before referencing a remote task path, confirm the repo path is a real in-tree file\ngit ls-tree -r --name-only HEAD | grep '^tasks/build.sh$'","typeGuard":null,"tryCatchPattern":"// Treat as a security rejection — do not retry with workarounds\nmatch err {\n    Err(e) if e.to_string().contains(\"escapes its Git checkout\") => warn_user_and_abort(e),\n    _ => continue,\n}","preventionTips":["Never point remote task URLs at symlinked paths.","Audit remote task repositories for symlinks that escape the checkout.","Pin remote task sources to a specific revision you have reviewed."],"tags":["security","path-traversal","remote-tasks","git"],"backgroundTag":"path-traversal-blocked","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}