Harden every NFS path that comes from a CSI request or from one of our volume/snapshot IDs.
Harden every NFS path that comes from a CSI request or from one of our volume/snapshot IDs.: a task in MiMo-V2.6-RL-oss: Agentic RL Environments (MiMo RL release). Today these values are fed through path joining before they are fully checked, so ./.., absolute subdirectories, metadata expansion…
The task
Today these values are fed through path joining before they are fully checked, so ./.., absolute subdirectories, metadata expansion, or extra ID fields can redirect controller work outside the intended export or working directory. Validation must reject the unsafe value…
Part of XiaomiMiMo/MiMo-V2.6-RL-oss.