fix(security): use relpath containment instead of startswith to prevent prefix-collision bypass

2026-05-16 04:23:04 +00:00
parent b0b28623a1
commit 1901eb6196
1 changed files with 2 additions and 1 deletions
@@ -263,7 +263,8 @@ class InlineToolExecutor:
                try:
                    resolved = Path(value).resolve()
                    sandbox_resolved = sandbox_path.resolve()
-                    if not str(resolved).startswith(str(sandbox_resolved)):
+                    rel = os.path.relpath(str(resolved), str(sandbox_resolved))
+                    if rel.startswith(".."):
                        return (
                            f"Path '{value}' for key '{key}' escapes sandbox "
                            f"root '{sandbox_path}'"