cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

fix(security): fix file_tools.py validate_path startswith bypass #7478 #11080

Open
HAL9000 wants to merge 3 commits from pr-fix-11002-validate-path-bypass into master
pull from: pr-fix-11002-validate-path-bypass
merge into: cleveragents:master
Conversation 6 Commits 3 Files Changed 5
+227 -1077

3 Commits

Author SHA1 Message Date
controller-ci-rerun 95d0914715 chore: re-trigger CI [controller]
CI / push-validation (pull_request) Successful in 22s
Details
CI / lint (pull_request) Failing after 42s
Details
CI / helm (pull_request) Successful in 33s
Details
CI / build (pull_request) Successful in 47s
Details
CI / typecheck (pull_request) Successful in 57s
Details
CI / quality (pull_request) Successful in 57s
Details
CI / security (pull_request) Successful in 1m2s
Details
CI / unit_tests (pull_request) Failing after 3m3s
Details
CI / coverage (pull_request) Has been skipped
Details
CI / docker (pull_request) Has been skipped
Details
CI / integration_tests (pull_request) Failing after 3m4s
Details
CI / e2e_tests (pull_request) Successful in 4m17s
Details
CI / status-check (pull_request) Failing after 3s
Details
2026-06-11 03:59:52 -04:00
CleverAgents Bot 281868f1dc ci: stop master workflow on PR updates
CI / lint (pull_request) Has been cancelled
Details
CI / typecheck (pull_request) Has been cancelled
Details
CI / security (pull_request) Has been cancelled
Details
CI / quality (pull_request) Has been cancelled
Details
CI / unit_tests (pull_request) Has been cancelled
Details
CI / integration_tests (pull_request) Has been cancelled
Details
CI / e2e_tests (pull_request) Has been cancelled
Details
CI / coverage (pull_request) Has been cancelled
Details
CI / build (pull_request) Has been cancelled
Details
CI / docker (pull_request) Has been cancelled
Details
CI / helm (pull_request) Has been cancelled
Details
CI / push-validation (pull_request) Has been cancelled
Details
CI / status-check (pull_request) Has been cancelled
Details 
Remove the stale pull_request trigger from master.yml so PR branch commits do not launch the master workflow.

Maintenance patch for PR #11080.
 2026-06-10 20:18:58 -04:00
HAL9000 b7ed4ed185 fix(security): fix file_tools.py validate_path startswith bypass #7478
CI / benchmark-publish (pull_request) Has been skipped
Details
CI / lint (pull_request) Failing after 54s
Details
CI / quality (pull_request) Successful in 1m11s
Details
CI / typecheck (pull_request) Successful in 1m25s
Details
CI / security (pull_request) Successful in 1m26s
Details
CI / benchmark-regression (pull_request) Failing after 58s
Details
CI / build (pull_request) Successful in 43s
Details
CI / helm (pull_request) Successful in 42s
Details
CI / push-validation (pull_request) Successful in 22s
Details
CI / unit_tests (pull_request) Failing after 4m29s
Details
CI / coverage (pull_request) Has been skipped
Details
CI / docker (pull_request) Has been skipped
Details
CI / integration_tests (pull_request) Successful in 5m8s
Details
CI / e2e_tests (pull_request) Successful in 5m25s
Details
CI / status-check (pull_request) Failing after 3s
Details 
- Add CHANGELOG.md Security section entry under [Unreleased] for the
  validate_path path traversal prefix-collision bypass vulnerability.
- Update CONTRIBUTORS.md with HAL 9000 contribution description for
  issue #7478 (file_tools.py validate_path startswith bypass fix).
- Fix BDD test scenario tag from @tdd_issue_7558 to @tdd_issue_7478
  in features/tool_builtins.feature.
- Add comprehensive BDD test scenarios covering all path traversal
  attack vectors (read, write, edit, delete, prefix collision).
- Add step definitions for escape-path validation scenarios.

ISSUES CLOSED: #7478
 2026-05-09 08:13:14 +00:00