fix(spec): reject path-traversal spec names#463
Merged
Conversation
A spec `name:` is used verbatim as a filename or directory segment by every adapter, so a value like `../../../tmp/pwned` made sync write a file outside the project tree (path traversal). Reject names that are not a single safe path segment at load, with a clear error. As defense-in-depth, emit.WriteFile now refuses any project-relative path that climbs above the project root. Adds loader and emit-level regression tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
name:is used verbatim as a filename/directory segment by every adapter. A value likename: ../../../tmp/pwnedmadesyncwrite a file outside the project tree (path traversal) — verified end-to-end (a crafted command spec wrote/tmp/...outside the project root)./,\, or..) at load, with a clear error naming the file.emit.WriteFilenow refuses any project-relative output path that climbs above the project root, catching traversals from any source (name, scope, direct Bundle construction).scopetraversal was already guarded; this closes the per-entrynamevector the bug-hunt surfaced.Test plan