From 0bd2770894bd2a9e8787843649786287695149f9 Mon Sep 17 00:00:00 2001
From: bradAGI <46579244+bradAGI@users.noreply.github.com>
Date: Mon, 24 Aug 2026 14:48:06 -0400
Subject: [PATCH] feat(google_adk): add ADK-117, TypeScript FunctionTool writes
 to the filesystem
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ADK-004 covers the Python path-safety case; the TypeScript half was
missing. Mirrors CSDK-012, including its coarse-signal caveat — it flags
any filesystem write rather than only unnormalized paths, because TS
path-normalization analysis is not yet wired.

The callback gate does not close this by default: ADK-102 and ADK-107 are
about before_tool_callback being present at all, and a callback that is
present still has to inspect the path itself and know which root is
allowed. Being wired up is not the same as containing anything. Agent
composition widens the reach too — any branch listing this tool can reach
it, and a write performed in one branch is visible to every agent reading
the shared session state afterward, so the fix belongs inside the tool.
---
 google_adk/path_safety.yaml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/google_adk/path_safety.yaml b/google_adk/path_safety.yaml
index e1dee07..689bf0e 100644
--- a/google_adk/path_safety.yaml
+++ b/google_adk/path_safety.yaml
@@ -32,3 +32,36 @@ rules:
     fix: >
       Resolve the path with `Path(...).resolve()` and assert it sits under an
       allowed root before opening.
+
+  - id: ADK-117
+    title: TypeScript FunctionTool writes to the filesystem
+    severity: low
+    confidence: 0.5
+    language: typescript
+    applies_to:
+      - adk_function_tool
+    scope: tool
+    match:
+      has_write_call: true
+    explanation: >
+      This TypeScript ADK FunctionTool writes to the filesystem. If the path or
+      the contents derive from the tool's arguments, the model chooses both, and
+      a prompt injection carried in retrieved content or an earlier tool result
+      can steer the write at any file the host process can reach. The callback
+      gate the ADK offers does not close this by default: ADK-102 and ADK-107
+      are about before_tool_callback being present at all, and a callback that
+      is present still has to inspect the path itself and know which root is
+      allowed — being wired up is not the same as containing anything. Agent
+      composition widens the reach too, since any branch of the tree that lists
+      this tool can reach it, and a write performed in one branch is visible to
+      every agent that reads the shared session state afterward. (Coarse signal
+      — it flags any filesystem write, not only unnormalized paths, because
+      TypeScript path-normalization analysis is not yet wired. Confirm the path
+      is genuinely model-supplied before acting.)
+    fix: >
+      Confine writes to a dedicated working directory: resolve the final path,
+      verify it stays under that root before writing, and reject absolute paths
+      and any input containing "..". Put the check inside the tool rather than
+      relying on a before_tool_callback, so it holds for every agent in the tree
+      that lists the tool. Where the tool only ever writes generated names,
+      derive the filename from an id rather than accepting a path from the model.