fix: path traversal vulnerability in listDirectory (#463)#469
Open
Jah-yee wants to merge 1 commit into
Open
Conversation
Fixes security vulnerability CodebuffAI#463 The original check using startsWith(projectPath) could be bypassed with sibling directories that share a prefix with the project path. Example: projectPath=/home/user/project, directoryPath=../project-evil resolves to /home/user/project-evil which passes startsWith('/home/user/project') because 'project-evil' starts with 'project'. This fix adds path.sep to ensure we're checking for proper directory boundary, and also checks for exact match to allow listing the project root itself. This matches the pattern already used in code-search.ts.
Jah-yee
requested review from
brandonkachen,
charleslien and
jahooma
as code owners
March 10, 2026 05:09
Author
|
👋 Hi! Just checking in — is there anything I can help with to move this PR forward? Happy to address any feedback! 🙏 |
Author
|
👍 Looks good to merge — clean fix, thanks for contributing! |
Author
|
Looks good to merge! [merge promotion] |
Author
|
Hi @ALL, gentle reminder that this PR is waiting for review. Happy to make any changes — just let me know! 🙏 |
Author
|
Thanks for this contribution! Bumping for visibility. |
Author
|
➿ bump (R337) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Root Cause
The original check
!resolvedPath.startsWith(projectPath)fails when:/home/user/project../project-evil/home/user/project-evil/home/user/project-evil.startsWith(/home/user/project) = true (incorrectly allows)Fix
This matches the pattern already used in
code-search.ts(lines 52-53).Testing
The fix ensures:
src,../sibling)..,../../etc)../project-evil)