From 159d66fc60a8fa2c8f4024b68589fe5dcbfee0bb Mon Sep 17 00:00:00 2001 From: Yasuhiro Matsumoto Date: Mon, 16 Feb 2026 00:22:40 +0900 Subject: [PATCH] security: fix workspace path restriction bypass in validatePath --- pkg/tools/filesystem.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/tools/filesystem.go b/pkg/tools/filesystem.go index 237687734..f1eabd7ab 100644 --- a/pkg/tools/filesystem.go +++ b/pkg/tools/filesystem.go @@ -29,7 +29,7 @@ func validatePath(path, workspace string, restrict bool) (string, error) { } } - if restrict && !strings.HasPrefix(absPath, absWorkspace) { + if restrict && absPath != absWorkspace && !strings.HasPrefix(absPath, absWorkspace+string(filepath.Separator)) { return "", fmt.Errorf("access denied: path is outside the workspace") }