# Security Considerations for the `dofs` Package in Cloudflare Computer

> Explore security considerations for the dofs package in Cloudflare Computer. Learn about defense-in-depth, capability-based RPC, and secure storage mutations.

- Repository: [Cloudflare/computer](https://github.com/cloudflare/computer)
- Tags: security-considerations
- Published: 2026-08-15

---

**The `dofs` package implements defense-in-depth security through capability-based RPC access, path sanitization, SQLite prepared statements, blob integrity checks, and mount isolation—each vetted by authority verification before any storage mutation occurs.**

The `dofs` package is the authoritative SQLite-backed storage layer that drives the Cloudflare Computer filesystem. Because it stores user data and mediates all filesystem operations, its security design centers on **capability-based access control** combined with multiple layers of validation. This article examines the specific security mechanisms implemented across the codebase, with direct references to source files and functions.

## Capability-Based Access Control

All mutable operations—writes, renames, deletes, and blob uploads—are exposed exclusively through the RPC surface defined in `capnweb`. The Durable Object that owns a mount creates a **provider stub** that is handed to the client; this stub carries the sole capability to invoke the provider's methods.

In [`src/provider.ts`](https://github.com/cloudflare/computer/blob/main/src/provider.ts), the `Provider` class exposes methods like `writeFile`, `rename`, and `remove` only to callers holding a valid stub reference. Without the stub, no client can reach the storage API, creating a foundational access control boundary.

```typescript
// Example: creating a mount-specific provider (the capability)
// Only code that receives this stub may invoke storage operations
import { Provider } from '@cloudflare/dofs';

async function mountProvider(doFs: Provider) {
  // All operations below are authorized only because `doFs` is a capability
  await doFs.writeFile('/foo.txt', new Uint8Array([1, 2, 3]));
}

```

## Authority Verification and Sync Security

Before any change is applied, the sync engine verifies that the mount remains **authoritative** for the target path. This prevents rogue or stale replicas from overwriting newer data.

The `applyChanges` function in [`src/sync/apply.ts`](https://github.com/cloudflare/computer/blob/main/src/sync/apply.ts) contains explicit guards: if the mount has lost authority (for example, because another replica has taken over), the operation throws before any database mutation occurs. Source comments note this as "learns the mount stayed authoritative" and the `authoritative on the mount` guard.

```typescript
// Example: sync apply respects authority
// `applyChanges` rejects if the mount is no longer authoritative
import { applyChanges } from '@cloudflare/dofs/sync';

await applyChanges(mountId, changesArray); // throws if not authoritative

```

The sync engine in [`src/sync/changes.ts`](https://github.com/cloudflare/computer/blob/main/src/sync/changes.ts) additionally enforces **revision-based conflict resolution**: incoming changes are applied only when their revision is newer than the local state. Stale updates are silently dropped, preventing rollback attacks.

## Path Sanitization and Traversal Protection

All filesystem calls route through the `Path` class in [`src/path.ts`](https://github.com/cloudflare/computer/blob/main/src/path.ts), which resolves relative components (`..`, `.`) and canonicalizes the result before any database lookup. Attempts to escape the mount root trigger `InvalidPathError` before any I/O occurs.

```typescript
// Example: safe path handling—any escape attempt throws
import { Path } from '@cloudflare/dofs';

try {
  const p = new Path('/my-mount', '../../etc/passwd');
  // `p.normalized` becomes '/my-mount' and constructor throws InvalidPathError
} catch (e) {
  console.error('Blocked path traversal:', e);
}

```

This validation layer ensures that no operation can reference files outside its designated mount boundary, even if malicious paths are supplied.

## Database Security and SQL Injection Mitigation

The storage layer in [`src/storage.ts`](https://github.com/cloudflare/computer/blob/main/src/storage.ts) uses **prepared statements** via the `better-sqlite3` wrapper for every query. User-supplied strings are never interpolated directly into SQL, eliminating injection vectors entirely. All parameter binding is handled by the underlying SQLite driver.

The [`with-db.ts`](https://github.com/cloudflare/computer/blob/main/with-db.ts) helper in [`src/fs/with-db.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/with-db.ts) enforces **per-mount database isolation**: each mount receives its own SQLite file and dedicated `Database` handle. Even with a buggy path, operations cannot cross into another mount's database.

## Blob Integrity and Resource Limits

Blob handling in [`src/fs/blobCache.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/blobCache.ts) implements **size validation and cryptographic integrity**:

- Uploads are checked against configurable size limits
- SHA-256 hashes are computed on write and verified on read
- Tampered or corrupted blobs are rejected before reaching application code

Resource exhaustion is prevented through [`src/fs/gc.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/gc.ts), which runs periodic garbage collection to prune orphaned blobs and enforce **maximum storage quotas per mount**.

## Safe Error Handling

All low-level failures map to curated error types defined in [`src/errors.ts`](https://github.com/cloudflare/computer/blob/main/src/errors.ts): `InvalidPathError`, `PermissionDeniedError`, `NotFoundError`, and others. These error objects avoid leaking internal stack traces, database state, or mount structure to callers, reducing information available to attackers.

## Summary

- **Capability-based access** via `Provider` stubs in [`src/provider.ts`](https://github.com/cloudflare/computer/blob/main/src/provider.ts) prevents unauthorized API calls
- **Authority verification** in [`src/sync/apply.ts`](https://github.com/cloudflare/computer/blob/main/src/sync/apply.ts) blocks stale or rogue replica writes
- **Path sanitization** in [`src/path.ts`](https://github.com/cloudflare/computer/blob/main/src/path.ts) eliminates directory traversal attacks
- **Prepared statements** in [`src/storage.ts`](https://github.com/cloudflare/computer/blob/main/src/storage.ts) prevent SQL injection
- **Mount isolation** via [`src/fs/with-db.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/with-db.ts) contains database breaches
- **Blob integrity checks** in [`src/fs/blobCache.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/blobCache.ts) verify data authenticity
- **Revision-based sync** in [`src/sync/changes.ts`](https://github.com/cloudflare/computer/blob/main/src/sync/changes.ts) prevents rollback attacks
- **Quota enforcement** in [`src/fs/gc.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/gc.ts) limits denial-of-service via resource exhaustion
- **Safe error types** in [`src/errors.ts`](https://github.com/cloudflare/computer/blob/main/src/errors.ts) avoid information leakage

## Frequently Asked Questions

### How does `dofs` prevent one user from accessing another user's files?

Each mount receives its own SQLite database file and isolated `Database` handle through [`src/fs/with-db.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/with-db.ts). The `Path` class in [`src/path.ts`](https://github.com/cloudflare/computer/blob/main/src/path.ts) canonicalizes all paths relative to the mount root and rejects any traversal attempt with `InvalidPathError`. Cross-mount access is impossible at both the filesystem and database layers.

### What protects against SQL injection in the `dofs` storage layer?

[`src/storage.ts`](https://github.com/cloudflare/computer/blob/main/src/storage.ts) uses prepared statements exclusively via the `better-sqlite3` wrapper. All user input is bound as parameters, never concatenated into query strings. This approach eliminates SQL injection vectors by design.

### How does `dofs` handle sync conflicts between multiple replicas?

The sync engine in [`src/sync/changes.ts`](https://github.com/cloudflare/computer/blob/main/src/sync/changes.ts) compares revision timestamps and applies changes only when the incoming revision is newer. [`src/sync/apply.ts`](https://github.com/cloudflare/computer/blob/main/src/sync/apply.ts) additionally verifies that the local mount remains authoritative before any mutation. Stale or unauthorized updates are rejected, preventing data rollback or split-brain scenarios.

### What prevents blob data from being corrupted or tampered with?

[`src/fs/blobCache.ts`](https://github.com/cloudflare/computer/blob/main/src/fs/blobCache.ts) computes SHA-256 hashes on blob upload and verifies them on every read. Size limits are enforced before storage allocation. Corrupted or oversized payloads trigger errors before reaching application code, ensuring data integrity throughout the storage lifecycle.