opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: fix workspace path restriction bypass in validatePath

Browse source
This commit is contained in:
Yasuhiro Matsumoto 2026-02-16 00:22:40 +09:00
parent 214b201bfa
commit 159d66fc60
No known key found for this signature in database
GPG key ID: F2EA90DF2C146D1E
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
pkg/tools/filesystem.go
View file

@ -29,7 +29,7 @@ func validatePath(path, workspace string, restrict bool) (string, error) {
} }
} }
if restrict && !strings.HasPrefix(absPath, absWorkspace) { if restrict && absPath != absWorkspace && !strings.HasPrefix(absPath, absWorkspace+string(filepath.Separator)) {
return "", fmt.Errorf("access denied: path is outside the workspace") return "", fmt.Errorf("access denied: path is outside the workspace")
} }