fix: add .max(500) path length validation to all AI tool schemas - #532
fix: add .max(500) path length validation to all AI tool schemas#532Somil450 wants to merge 1 commit into
Conversation
Closes piyushdotcomm#522 The path field in all four tool schemas (read_file, edit_file, edit_multiple_files, delete_file) was an unbounded z.string(). While the content field already had a 100k char cap, an adversarial or runaway AI could craft an extremely long path string with no validation. Adds .max(500) to every path field - plenty for any real file path, blocks unbounded payload attacks.
|
Warning Review limit reached
Next review available in: 54 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
👋 Thanks for opening a PR, @Somil450!Your PR has entered the 🚦 PR Review Pipeline.
What happens next
A pipeline status comment will appear below and update automatically as your PR progresses. While you wait
This comment is posted only once. |
PR Summary by QodoFix: cap AI tool
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Code Review by Qodo
Context used✅ Compliance rules (platform):
22 rules 1. path schema allows traversal
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| path: z.string().max(500).describe("The file path relative to the project root, e.g. src/App.tsx or package.json"), | ||
| }), | ||
| edit_file: z.object({ | ||
| path: z.string().describe("The file path relative to the project root"), | ||
| path: z.string().max(500).describe("The file path relative to the project root"), | ||
| // Prevent overly large content (character limit) | ||
| content: z.string() | ||
| .max(MAX_FILE_CONTENT_CHARS, { message: `content exceeds max characters (${MAX_FILE_CONTENT_CHARS})` }), | ||
| }), | ||
| edit_multiple_files: z.object({ | ||
| changes: z.array(z.object({ | ||
| path: z.string().describe("The file path relative to the project root"), | ||
| path: z.string().max(500).describe("The file path relative to the project root"), | ||
| // Same protections for batch changes | ||
| content: z.string() | ||
| .max(MAX_FILE_CONTENT_CHARS, { message: `content exceeds max characters (${MAX_FILE_CONTENT_CHARS})` }), | ||
| })).max(MAX_BATCH_CHANGES, { message: `changes array exceeds max batch size (${MAX_BATCH_CHANGES})` }).describe("An array of file modifications to execute as a batch"), | ||
| }), | ||
| delete_file: z.object({ | ||
| path: z.string().describe("The file path relative to the project root"), | ||
| path: z.string().max(500).describe("The file path relative to the project root"), |
There was a problem hiding this comment.
1. path schema allows traversal 📘 Rule violation ⛨ Security
The updated path fields only cap string length and still accept traversal/absolute-path patterns (e.g., ../, leading /, backslashes). If these tool inputs are used for filesystem operations, this can enable directory traversal outside the intended project root.
Agent Prompt
## Issue description
`path` inputs for `read_file`, `edit_file`, `edit_multiple_files.changes[].path`, and `delete_file` are only constrained by length (`.max(500)`) and do not explicitly reject directory traversal or absolute paths.
## Issue Context
These schemas represent a system-boundary input validation layer for tool calls and should enforce safe relative paths (e.g., reject `..`, leading `/`, and `\\`).
## Fix Focus Areas
- app/api/chat/tools.ts[18-35]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
2 participants
Closes #522
The path field in all four tool schemas (read_file, edit_file, edit_multiple_files, delete_file) was an unbounded z.string(). While the content field already had a 100k char cap, an adversarial or runaway AI could craft an extremely long path string with no validation.
Adds .max(500) to every path field - plenty for any real file path, blocks unbounded payload attacks.
Summary
Summary
Closes #522
Adds
.max(500)length validation to everypathfield across all four AI tool schemas inapp/api/chat/tools.ts.Problem
The
contentfield already had a 100,000-character cap, but allpathfields were unboundedz.string()with no length limit. An adversarial or runaway AI could generate an extremely long path string, bypassing input validation and wasting server resources.Change
// Before path: z.string().describe("The file path relative to the project root") // After path: z.string().max(500).describe("The file path relative to the project root")Applied to all 4 tool schemas:
read_fileedit_fileedit_multiple_files(innerpathfield)delete_file500 characters is well beyond any realistic file path, while blocking unbounded payload attacks.
Files Changed
app/api/chat/tools.ts- 4 lines changed (one per tool schema)Type of change
Related issue
Closes #
Validation
npm run lintnpm testnpm run buildList any additional manual verification you performed:
Screenshots or recordings
Add screenshots or short recordings for UI changes when relevant.
Checklist