cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [security] Path traversal vulnerability in plan_generation.py #3089

New issue

Open

opened 2026-04-05 05:48:59 +00:00 by freemo · 1 comment

freemo commented

2026-04-05 05:48:59 +00:00

Owner

Metadata

Branch: fix/security-path-traversal-plan-generation
Commit Message: fix(agents): validate extracted file path in _generate_plan to prevent path traversal
Milestone: (none — see backlog note below)
Parent Epic: #362

Backlog note: This issue was discovered during autonomous operation
on milestone v3.2.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Bug Report: [security] — Path traversal vulnerability in plan_generation.py

Severity Assessment

Impact: An attacker could potentially read or write files outside of the intended directory.
Likelihood: Medium, as it requires a malicious user to craft a specific prompt.
Priority: High

Location

File: src/cleveragents/agents/graphs/plan_generation.py
Function/Class: _generate_plan
Lines: 403

Description

The _extract_path_from_prompt function in plan_generation.py could be vulnerable to path traversal attacks. The path extracted from the prompt is used to construct a file path, and there are no checks to prevent a malicious user from providing a path like ../../etc/passwd.

Evidence

            explicit_path = self._extract_path_from_prompt(state.get("prompt", ""))

            if operation == "modify" and contexts:
                matched_context = self._find_matching_context(contexts, explicit_path)
                target_context = matched_context or contexts[0]
                file_path = target_context.path
                operation_type = OperationType.MODIFY
                original_content = target_context.content
            elif explicit_path:
                file_path = explicit_path

Expected Behavior

The code should validate the extracted path to ensure it is within the project's root directory.

Actual Behavior

The extracted path is used without proper validation, which could lead to a path traversal vulnerability.

Suggested Fix

Use os.path.abspath and check if the path starts with the project's root directory.

import os

def _validate_path(self, path: str, root: str) -> str:
    abs_path = os.path.abspath(path)
    abs_root = os.path.abspath(root)
    if not abs_path.startswith(abs_root + os.sep):
        raise ValueError(f"Path traversal detected: {path!r} is outside project root {root!r}")
    return abs_path

Subtasks

Identify the project root directory reference available at the point _generate_plan is called
Implement a _validate_path helper (or inline check) using os.path.abspath to confirm the resolved path starts with the project root
Apply the validation to explicit_path before it is assigned to file_path in the elif explicit_path: branch
Raise a descriptive ValueError (or appropriate domain exception) when a traversal attempt is detected
Add Behave unit tests covering: valid paths, relative traversal (../../etc/passwd), absolute paths outside root, and symlink edge cases
Verify all nox sessions pass

Definition of Done

_generate_plan rejects any explicit_path that resolves outside the project root directory
A ValueError (or domain-specific exception) is raised with a clear message on traversal attempts
New Behave unit tests cover all path-validation branches (valid, traversal, absolute-outside, symlink)
No # type: ignore suppressions introduced
All nox stages pass
Coverage >= 97%

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/security-path-traversal-plan-generation` - **Commit Message**: `fix(agents): validate extracted file path in _generate_plan to prevent path traversal` - **Milestone**: *(none — see backlog note below)* - **Parent Epic**: #362 > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.2.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. ## Bug Report: [security] — Path traversal vulnerability in plan_generation.py ### Severity Assessment - **Impact**: An attacker could potentially read or write files outside of the intended directory. - **Likelihood**: Medium, as it requires a malicious user to craft a specific prompt. - **Priority**: High ### Location - **File**: `src/cleveragents/agents/graphs/plan_generation.py` - **Function/Class**: `_generate_plan` - **Lines**: 403 ### Description The `_extract_path_from_prompt` function in `plan_generation.py` could be vulnerable to path traversal attacks. The path extracted from the prompt is used to construct a file path, and there are no checks to prevent a malicious user from providing a path like `../../etc/passwd`. ### Evidence ```python explicit_path = self._extract_path_from_prompt(state.get("prompt", "")) if operation == "modify" and contexts: matched_context = self._find_matching_context(contexts, explicit_path) target_context = matched_context or contexts[0] file_path = target_context.path operation_type = OperationType.MODIFY original_content = target_context.content elif explicit_path: file_path = explicit_path ``` ### Expected Behavior The code should validate the extracted path to ensure it is within the project's root directory. ### Actual Behavior The extracted path is used without proper validation, which could lead to a path traversal vulnerability. ### Suggested Fix Use `os.path.abspath` and check if the path starts with the project's root directory. ```python import os def _validate_path(self, path: str, root: str) -> str: abs_path = os.path.abspath(path) abs_root = os.path.abspath(root) if not abs_path.startswith(abs_root + os.sep): raise ValueError(f"Path traversal detected: {path!r} is outside project root {root!r}") return abs_path ``` ### Category security ## Subtasks - [ ] Identify the project root directory reference available at the point `_generate_plan` is called - [ ] Implement a `_validate_path` helper (or inline check) using `os.path.abspath` to confirm the resolved path starts with the project root - [ ] Apply the validation to `explicit_path` before it is assigned to `file_path` in the `elif explicit_path:` branch - [ ] Raise a descriptive `ValueError` (or appropriate domain exception) when a traversal attempt is detected - [ ] Add Behave unit tests covering: valid paths, relative traversal (`../../etc/passwd`), absolute paths outside root, and symlink edge cases - [ ] Verify all nox sessions pass ## Definition of Done - [ ] `_generate_plan` rejects any `explicit_path` that resolves outside the project root directory - [ ] A `ValueError` (or domain-specific exception) is raised with a clear message on traversal attempts - [ ] New Behave unit tests cover all path-validation branches (valid, traversal, absolute-outside, symlink) - [ ] No `# type: ignore` suppressions introduced - [ ] All nox stages pass - [ ] Coverage >= 97% --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

freemo added a new dependency

2026-04-05 05:49:58 +00:00

#362 Epic: Security & Safety Hardening

freemo added this to the v3.6.0 milestone

2026-04-05 06:18:03 +00:00

freemo added a new dependency

2026-04-05 06:19:01 +00:00

#400 Epic: Post-MVP Security

freemo commented

2026-04-05 06:19:39 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: High — security vulnerability allowing potential path traversal in plan generation; user-controlled input reaches file system operations without validation
Milestone: v3.6.0 (Post-MVP Security scope)
MoSCoW: Should Have — security fix that hardens the system against malicious prompts; not blocking current milestone completion but important for production readiness
Parent Epic: #400 (Post-MVP Security)

Note: The issue body references Epic #362 (Security & Safety Hardening, v3.3.0), but since this was discovered as a backlog item and v3.3.0 is past due, I've assigned it to v3.6.0 under Epic #400 (Post-MVP Security) which is the appropriate scope for post-MVP security hardening work.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: ca-project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: High — security vulnerability allowing potential path traversal in plan generation; user-controlled input reaches file system operations without validation - **Milestone**: v3.6.0 (Post-MVP Security scope) - **MoSCoW**: Should Have — security fix that hardens the system against malicious prompts; not blocking current milestone completion but important for production readiness - **Parent Epic**: #400 (Post-MVP Security) **Note:** The issue body references Epic #362 (Security & Safety Hardening, v3.3.0), but since this was discovered as a backlog item and v3.3.0 is past due, I've assigned it to v3.6.0 under Epic #400 (Post-MVP Security) which is the appropriate scope for post-MVP security hardening work. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: ca-project-owner

freemo referenced this issue

2026-04-05 06:22:37 +00:00

[CA-AUTO] UAT Pool Supervisor — v3.2.0–v3.7.0 — Session Tracker #3094

freemo referenced this issue

2026-04-05 06:43:52 +00:00

[CA-AUTO] UAT Pool Supervisor — v3.2.0–v3.7.0 — Session Tracker #3094

freemo referenced this issue

2026-04-05 08:26:27 +00:00

BUG: [security] Potential prompt injection vulnerability in agent graphs #3236

freemo referenced this issue

2026-04-05 08:35:43 +00:00

[CA-AUTO] UAT Pool Supervisor — v3.2.0–v3.7.0 — Session Tracker #3094