def test_docker_security_validation():
    """Test that path traversal attempts are properly blocked"""

    with tempfile.TemporaryDirectory() as tmpdir:
        # Set up directories
        host_workspace = Path(tmpdir) / "workspace"
        host_workspace.mkdir()
        secret_dir = Path(tmpdir) / "secret"
        secret_dir.mkdir()
        secret_file = secret_dir / "password.txt"
        secret_file.write_text("secret")

        # Create a symlink inside workspace pointing to secret
        symlink = host_workspace / "link_to_secret"
        symlink.symlink_to(secret_file)

        original_env = os.environ.copy()
        try:
            os.environ["WORKSPACE_ROOT"] = str(host_workspace)
            os.environ["MCP_PROJECT_ROOT"] = str(host_workspace)

            # Reload the module
            importlib.reload(utils.file_utils)
            utils.file_utils.CONTAINER_WORKSPACE = Path("/workspace")

            from utils.file_utils import resolve_and_validate_path

            # Trying to access the symlink should fail
            with pytest.raises(PermissionError):
                resolve_and_validate_path(str(symlink))

        finally:
            os.environ.clear()
            os.environ.update(original_env)
            importlib.reload(utils.file_utils)
Test that path traversal attempts are properly blocked
tests/test_docker_path_integration.py