[PR #6389] [CLOSED] fix(domain): reject path traversal and drive-relative paths in hostAbsoluteSchema #7331

New issue

Closed

opened 2026-11-01 21:47:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:47:07 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6389
Author: @ZG0D-FF
Created: 10/22/2026
Status: ❌ Closed

Base: main ← Head: fix/domain-host-path-traversal

📝 Commits (1)

9d05a40 fix(domain): reject path traversal and drive-relative paths in hostAbsoluteSchema

📊 Changes

1 file changed (+9 additions, -0 deletions)

View changed files

📝 src/domain/localPath.ts (+9 -0)

📄 Description

Summary

Fixes #5493, Fixes #5450.
Rejects path traversal segments (..) and Windows root-relative paths (/foo) in host-absolute path validation schemas.

Problem and expected behavior

Standard path.isAbsolute() admits root-relative paths on Windows and permits embedded .. traversal segments (e.g. C:\safe..\windows\system32), resolving unexpectedly against host working directories.

Change and scope

Added hostAbsolutePathSchema to src/domain/localPath.ts requiring isAbsolute(val), !val.startsWith("/"), and !val.split(/[\/]+/).includes("..").

Contract and boundary impact

Semantic owner: domain/contracts
Contribution scope fit: security / containment
CLI and MCP/tool-catalog contract: tighter schema validation on file targets

Author readiness

Human owner: @ZG0D-FF

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6389 **Author:** [@ZG0D-FF](https://github.com/ZG0D-FF) **Created:** 10/22/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/domain-host-path-traversal` --- ### 📝 Commits (1) - [`9d05a40`](https://github.com/morluto/rea/commit/9d05a40c94201df37887363981efdf8cb7162e22) fix(domain): reject path traversal and drive-relative paths in hostAbsoluteSchema ### 📊 Changes **1 file changed** (+9 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/localPath.ts` (+9 -0) </details> ### 📄 Description ## Summary Fixes #5493, Fixes #5450. Rejects path traversal segments (..) and Windows root-relative paths (/foo) in host-absolute path validation schemas. ## Problem and expected behavior Standard path.isAbsolute() admits root-relative paths on Windows and permits embedded .. traversal segments (e.g. C:\safe\..\windows\system32), resolving unexpectedly against host working directories. ## Change and scope Added hostAbsolutePathSchema to src/domain/localPath.ts requiring isAbsolute(val), !val.startsWith("/"), and !val.split(/[\\/]+/).includes(".."). ## Contract and boundary impact - Semantic owner: domain/contracts - Contribution scope fit: security / containment - CLI and MCP/tool-catalog contract: tighter schema validation on file targets ## Author readiness Human owner: @ZG0D-FF - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:47:07 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7331

No description provided.

Rows
Columns