Fix filesystem whitelist validation to prevent prefix bypasses #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

zsio wants to merge 1 commit into wbopan:main from zsio:fix/fs-allowed-path-validation

zsio commented Sep 21, 2025

normalize allowed base paths and ensure target directories stay within them using path.relative
reject look-alike sibling directories that only share a string prefix with the whitelist
add unit coverage proving the stricter guard while keeping existing behaviour intact


          Fix filesystem whitelist directory checks

e8f9df8

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet