cleveragents/cleveragents-core
4
0
Fork 3
Code Issues 6.0k Pull Requests 115 Actions Packages Projects Releases Wiki Activity

fix(agents): validate file paths in ContextAnalysisAgent._load_files to prevent path traversal #9229

Open
HAL9000 wants to merge 5 commits from fix/context-analysis-agent-path-traversal into master
pull from: fix/context-analysis-agent-path-traversal
merge into: cleveragents:master
Conversation 21 Commits 5 Files Changed 14
+951 -25

5 Commits

Author SHA1 Message Date
HAL9000 a07f4a8afb fix(agents): plumb allowed_base_dir through ContextService and BDD fixtures
CI / lint (pull_request) Successful in 32s
Details
CI / push-validation (pull_request) Successful in 31s
Details
CI / build (pull_request) Successful in 34s
Details
CI / helm (pull_request) Successful in 34s
Details
CI / quality (pull_request) Successful in 54s
Details
CI / typecheck (pull_request) Successful in 1m0s
Details
CI / security (pull_request) Successful in 1m13s
Details
CI / unit_tests (pull_request) Failing after 4m48s
Details
CI / coverage (pull_request) Has been skipped
Details
CI / docker (pull_request) Has been skipped
Details
CI / integration_tests (pull_request) Successful in 9m15s
Details
CI / status-check (pull_request) Failing after 3s
Details 
The previous attempt fixed only two BDD steps (scenarios at lines 17 and
40 of context_analysis_graph_coverage.feature), leaving four more
scenarios still rejecting absolute /tmp paths under the new path-
traversal sandbox: scenarios 24 + 32 of the same file, plus broken
scenarios in context_analysis_coverage_boost.feature,
context_analysis_new_coverage.feature, and the service-level scenarios
80 + 97 of context_service_coverage_gaps.feature.

Production fix: ContextService._get_context_agent now accepts an
allowed_base_dir argument; analyze_context, analyze_context_async,
analyze_context_streaming, and analyze_context_streaming_async all
pass str(project.path) so the agent's sandbox boundary matches the
project workspace. Files inside the project are accepted; traversal
outside it is rejected — the security goal is preserved.

Test fixtures: the _ensure_agent helpers in graph_coverage and
agent_coverage step files, the bare ContextAnalysisAgent constructors
in new_coverage and coverage_boost step files, and the custom-LLM
constructor in graph_coverage all now default allowed_base_dir to
Path("/tmp").resolve(). Every temp file in these fixtures lands under
/tmp via tempfile.mkdtemp / NamedTemporaryFile, so the sandbox now
accepts the absolute paths the tests pass.

ISSUES CLOSED: #9093
 2026-06-03 01:47:25 -04:00
HAL9000 7a8f9ffceb fix(agents): resolve lint E501 and unit test allowed_base_dir failures 
- Shorten long line in robot/helper_context_analysis.py (E501, 99>88)
  by extracting the traversal path string to a local variable
- Fix 4 failing BDD scenarios in context_analysis_graph_coverage and
  context_analysis_new_coverage: steps passed absolute /tmp paths to
  _load_files but agent.allowed_base_dir defaulted to CWD, causing
  _validate_file_path to return "Path traversal attempt" instead of
  the expected "File not found"/"Not a file" errors. Set
  allowed_base_dir = Path("/tmp").resolve() in the affected When steps.

ISSUES CLOSED: #9093
 2026-06-03 01:47:25 -04:00
HAL9000 628cbc6bf2 fix(agents): add path traversal tests, update CHANGELOG (#9229) and CONTRIBUTORS 
Update:
  - CHANGELOG.md reference from #9093 to actual PR #9229
  - CONTRIBUTORS.md with specific CWE-22 path traversal fix entry for
    ContextAnalysisAgent by HAL 9000
  - Robot Framework helper tests covering valid paths, traversal
    rejection, and preloaded-doc bypass behavior.
  - New BDD feature file context_analysis_path_traversal.feature

ISSUES CLOSED: #9229
 2026-06-03 01:47:25 -04:00
HAL9000 9c0701b739 fix(agents): validate file paths in ContextAnalysisAgent._load_files to prevent path traversal 
Replace vulnerable os.path.commonpath containment check with
Path.relative_to() which is immune to directory-prefix collision
attacks (CWE-22). Switch from os.path.abspath() to Path.resolve()
so symlinks are followed before the containment check, preventing
symlink-based sandbox escapes. Use resolved paths for all file
operations in _load_files to ensure consistency between validation
and loading.

Remove dead cleanup handler code from step definitions — temp dir
cleanup is already handled by after_scenario in environment.py.
Add config with thread_id to agent invoke calls for checkpointer
compatibility.

Add Robot Framework integration tests for end-to-end path traversal
verification covering traversal rejection, absolute escape rejection,
valid path loading, mixed path handling, and symlink traversal.

Update CHANGELOG.md with security fix entry.

ISSUES CLOSED: #9093
EOF && git -C /tmp/implementation-worker-1776905858762787244/repo push --force-with-lease origin fix/context-analysis-agent-path-traversal
 2026-06-03 01:47:25 -04:00
HAL9000 d60d4b6981 fix(agents): validate file paths in ContextAnalysisAgent._load_files to prevent path traversal 
Implements path validation to prevent CWE-22 path traversal attacks in ContextAnalysisAgent._load_files method.

Changes:
- Add allowed_base_dir parameter to ContextAnalysisAgent.__init__
- Implement _validate_file_path method to check paths against allowed base directory
- Validate all file paths before loading to prevent directory traversal
- Reject paths that resolve outside the allowed directory with clear error messages
- Add comprehensive Behave BDD tests for path traversal prevention
- Add step definitions for security testing

The fix ensures that all file paths are validated against an allowed base directory before loading, preventing attackers from reading files outside the intended scope using path traversal techniques like '../../../etc/passwd'.
 2026-06-03 01:47:25 -04:00