security: isPathSafe must not allow sibling-prefix directory escapes - #18
Merged
Merged
Conversation
isPathSafe() — the check behind the granted-directory permission model (file-access-manager reads/writes/lists all gate on it) — used a bare resolved.startsWith(allowed). A sibling directory that shares the name prefix, e.g. /a/photos-evil for a grant on /a/photos, passed the check and could be read or written outside the granted scope. Require the path to equal the granted directory or start with it plus a path separator. Test (red before fix): tests/unit/file-access-types.test.ts covers the sibling-prefix escape, in-grant access, and a traversal that resolves out. Follow-up: the READ_FILE IPC handler validates only length / '..' patterns (input-validator.validateFilePath) and does not constrain to a granted directory — it should route through the granted-dir model too (separate change, behaviour-affecting). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Was
isPathSafe()— die Prüfung hinter dem Granted-Directory-Modell — erlaubte Sibling-Prefix-Escapes.Warum
resolved.startsWith(allowed)ist der klassische Prefix-Bug: ein Geschwisterverzeichnis mit gleichem Namenspräfix (z.B./a/photos-evilbei einem Grant auf/a/photos) bestand die Prüfung.file-access-manager(Read/Write/List) gatet an allen drei Stellen darauf → Zugriff ausserhalb des gewährten Bereichs.Änderungen
isPathSafe: Pfad muss das Grant-Verzeichnis sein oder mit ihm plus Separator beginnen.tests/unit/file-access-types.test.ts— Sibling-Prefix-Escape, In-Grant-Zugriff, Traversal-nach-aussen.Tests
vitest run tests/unit/file-access-types.test.ts: 5/5.tsc -p tsconfig.main.jsonclean.Review-Punkte / Follow-up
..-Muster (validateFilePath), nicht gegen die Granted-Dirs — kann jeden absoluten Pfad lesen. Das ist ein separater, verhaltensändernder Fix (READ_FILE durch das Granted-Dir-Modell routen).Dokumentation
Security-Audit-Bericht (2026-08-21), Mingly Low-Finding (path-traversal).
🤖 Generated with Claude Code