Repository navigation
security: confine request-derived filesystem paths (43 js/path-injection alerts) - #77
Merged
Merged
Conversation
…jection alerts)
Add lib/safe-path.js: resolveInside(base, ...parts) resolves under a trusted
base and rejects '..', absolute segments and NUL bytes; resolveAllowedDir()
validates ?dir= overrides (absolute, no '..', realpath inside HOME / configured
dirs / AGENTXRAY_ALLOWED_DIRS). Every path join built from request input now
goes through these. An /api middleware answers 403 for a bad dir* param.
sanitizeAgentName/sanitizeSessionId no longer accept dot-only names ('..').
Tests: 7 new cases (traversal 403/400, symlink escape, normal dir still served,
helper unit tests). Test count 349 -> 356 in claims.json and ROADMAP.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes all 43 open
js/path-injectionCodeQL alerts on master (5e48017) with a central path guard instead of suppressions.Triage (from the alert data flows)
req.query.dir/dirCodex… →resolveDir()(routes/sessions, insights, prompts, watch, export, search)req.params.name/:sessionId→sanitizeAgentName/sanitizeSessionId.., so/api/agents/%2E%2E/sessionswalked up one level.LIBRARY_NAME_RE), prompts analysis key ([a-z0-9-])Fix
lib/safe-path.js:resolveInside(base, ...parts)(path.resolve + must stay inside base; rejects..escape, absolute segments, NUL) andresolveAllowedDir(input)(absolute, no.., realpath must sit inside HOME / the configured platform & storage dirs /AGENTXRAY_ALLOWED_DIRS). Errors arePathEscapeError(status 403).resolveDir()usesresolveAllowedDir; every request-derived join in platforms/openclaw, claude, omp, hermes, routes/sessions, search, library, prompts usesresolveInside./apimiddleware returns 403 for any baddir*query param before routes run.Tests (added to existing files; test-file count stays 22)
api.test.js:
?dir=/etc, parent of HOME,../escape, relative, NUL,dirCodex=/etc→ 403; symlink in HOME pointing outside → 403; explicit?dir=inside HOME returns the same sessions as default;%2E%2Eagent/session → 400. unit.test.js: helper unit tests. 349 → 356 tests; claims.json + ROADMAP updated (gate unchanged).Local evidence (Node 22.23.3)
npm test:# tests 356 # pass 356 # fail 016 machine-checked · 16 ok · 0 failed · 0 error · 3 manual