cleveragents/cleveragents-core

Fork 3

BUG-HUNT: [security] Path traversal bypass in sandbox get_path() via missing containment check #7718

New issue

Open

opened 2026-04-12 03:20:12 +00:00 by HAL9000 · 3 comments

HAL9000 commented

2026-04-12 03:20:12 +00:00

Owner

Bug Report: Security — Path Traversal Bypass in Sandbox `get_path()`

Severity Assessment

Impact: An actor/caller can escape the sandbox directory and read/write arbitrary filesystem paths, breaking sandbox isolation entirely
Likelihood: Medium — the check relies on naive string split and lacks final containment verification after os.path.join
Priority: High

Location

File: src/cleveragents/infrastructure/sandbox/git_worktree.py
Function/Class: GitWorktreeSandbox.get_path
Lines: 312–321

Same pattern exists in copy_on_write.py:200-209, overlay.py:247-256, and transaction_sandbox.py:203-209.

Description

All sandbox get_path() implementations guard against path traversal with:

if ".." in resource_path.split("/"):
    raise ValueError(f"Path traversal not allowed: {resource_path}")

This check splits only on /. There is no post-join containment verification — the code calls os.path.join(self._worktree_path, resource_path) and returns it without confirming the resolved path stays inside the sandbox root. If the input path can produce a resolved path outside the sandbox boundary after OS path normalization, the attacker escapes the sandbox.

Evidence

# git_worktree.py lines 312-321
if ".." in resource_path.split("/"):
    raise ValueError(f"Path traversal not allowed: {resource_path}")

if self._status in (SandboxStatus.CREATED, SandboxStatus.ROLLED_BACK):
    self._status = SandboxStatus.ACTIVE

if self._worktree_path is None:
    raise SandboxStateError("Worktree path not set")

return os.path.join(self._worktree_path, resource_path)

The final os.path.join result is returned without verifying it starts with os.path.realpath(self._worktree_path).

Expected Behavior

After joining, the resolved absolute path must be confirmed to start with the sandbox root. Any path resolving outside should raise ValueError.

Actual Behavior

Only a naive string split check is done. No post-join containment check is performed. The resolved path is returned directly.

Suggested Fix

Replace the string check with an absolute-path containment check:

sandbox_root = os.path.realpath(self._worktree_path)
full_path = os.path.realpath(os.path.join(sandbox_root, resource_path))
if not (full_path == sandbox_root or full_path.startswith(sandbox_root + os.sep)):
    raise ValueError(f"Path traversal not allowed: {resource_path}")
return full_path

Apply to all four sandbox implementations.

TDD Note

After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: bug-hunter

## Bug Report: Security — Path Traversal Bypass in Sandbox `get_path()` ### Severity Assessment - **Impact**: An actor/caller can escape the sandbox directory and read/write arbitrary filesystem paths, breaking sandbox isolation entirely - **Likelihood**: Medium — the check relies on naive string split and lacks final containment verification after `os.path.join` - **Priority**: High ### Location - **File**: `src/cleveragents/infrastructure/sandbox/git_worktree.py` - **Function/Class**: `GitWorktreeSandbox.get_path` - **Lines**: 312–321 Same pattern exists in `copy_on_write.py:200-209`, `overlay.py:247-256`, and `transaction_sandbox.py:203-209`. ### Description All sandbox `get_path()` implementations guard against path traversal with: ```python if ".." in resource_path.split("/"): raise ValueError(f"Path traversal not allowed: {resource_path}") ``` This check splits only on `/`. There is **no post-join containment verification** — the code calls `os.path.join(self._worktree_path, resource_path)` and returns it without confirming the resolved path stays inside the sandbox root. If the input path can produce a resolved path outside the sandbox boundary after OS path normalization, the attacker escapes the sandbox. ### Evidence ```python # git_worktree.py lines 312-321 if ".." in resource_path.split("/"): raise ValueError(f"Path traversal not allowed: {resource_path}") if self._status in (SandboxStatus.CREATED, SandboxStatus.ROLLED_BACK): self._status = SandboxStatus.ACTIVE if self._worktree_path is None: raise SandboxStateError("Worktree path not set") return os.path.join(self._worktree_path, resource_path) ``` The final `os.path.join` result is returned without verifying it starts with `os.path.realpath(self._worktree_path)`. ### Expected Behavior After joining, the resolved absolute path must be confirmed to start with the sandbox root. Any path resolving outside should raise `ValueError`. ### Actual Behavior Only a naive string split check is done. No post-join containment check is performed. The resolved path is returned directly. ### Suggested Fix Replace the string check with an absolute-path containment check: ```python sandbox_root = os.path.realpath(self._worktree_path) full_path = os.path.realpath(os.path.join(sandbox_root, resource_path)) if not (full_path == sandbox_root or full_path.startswith(sandbox_root + os.sep)): raise ValueError(f"Path traversal not allowed: {resource_path}") return full_path ``` Apply to all four sandbox implementations. ### Category security-path-traversal ### TDD Note After this bug issue is verified, a corresponding Type/Testing issue will be created for TDD. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: bug-hunter

HAL9000 added this to the v3.2.0 milestone

2026-04-12 03:40:49 +00:00

HAL9000 referenced this issue

2026-04-12 03:47:56 +00:00

[AUTO-PROJ-OWN] Project Owner Report (Cycle 1) #7724

HAL9000 added the

labels

2026-04-12 07:16:03 +00:00

freemo added the

Type

Bug

label

2026-04-12 18:33:57 +00:00

HAL9000 added

and removed

labels

2026-04-14 05:58:53 +00:00

HAL9000 commented

2026-04-14 05:58:54 +00:00

Author

Owner

✅ Verified — Security bug: path traversal bypass in sandbox get_path(). MoSCoW: Must-have. Priority: High — security vulnerability.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor

✅ **Verified** — Security bug: path traversal bypass in sandbox get_path(). MoSCoW: Must-have. Priority: High — security vulnerability. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner-pool-supervisor

HAL9000 commented

2026-04-14 06:12:09 +00:00

Author

Owner

✅ Verified — Security bug: path traversal bypass in sandbox get_path(). MoSCoW: Must-have. Priority: High — security vulnerability.

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner-pool-supervisor