From c82b4f17f731f5a4603ece763abaf5fff6e6ea09 Mon Sep 17 00:00:00 2001 From: Samy6767f Date: Mon, 24 Aug 2026 18:55:09 +0530 Subject: [PATCH] =?UTF-8?q?fix:=20use=20strict=20child=20check=20in=20path?= =?UTF-8?q?=20containment=20=E2=80=94=20reject=20clone=5Fpath=20=3D=3D=20t?= =?UTF-8?q?emp=5Fdir?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous startswith check accepted clone_path equal to temp_dir itself (a string starts with itself), so '..git' deriving '.' would still resolve to temp_dir and pass through to shutil.rmtree. Now requires clone_path to be a strict descendant: adds equality rejection and uses os.sep-terminated prefix to also prevent sibling directory prefix collisions. --- strix/interface/utils.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/strix/interface/utils.py b/strix/interface/utils.py index 8a80942b..6030fa6b 100644 --- a/strix/interface/utils.py +++ b/strix/interface/utils.py @@ -1565,10 +1565,14 @@ def clone_repository(repo_url: str, run_name: str, dest_name: str | None = None) else: repo_name = derive_repo_base_name(repo_url) - # Guard against path traversal: the derived name must not resolve - # outside the temp directory (e.g. ".." or "."). + # Guard against path traversal: the derived name must resolve to a + # strict child of the temp directory — not temp_dir itself, and not + # any path outside it (e.g. "." or ".."). clone_path = (temp_dir / repo_name).resolve() - if not str(clone_path).startswith(str(temp_dir.resolve())): + temp_dir_resolved = temp_dir.resolve() + if clone_path == temp_dir_resolved or not str(clone_path).startswith( + str(temp_dir_resolved) + os.sep + ): raise ValueError( f"Refusing to clone: derived directory name '{repo_name}' " f"escapes the temporary directory"