Files
cleveragents-core/features
HAL9000 5fca547fda
CI / benchmark-publish (pull_request) Has been skipped
CI / push-validation (pull_request) Successful in 28s
CI / helm (pull_request) Successful in 46s
CI / lint (pull_request) Failing after 1m10s
CI / build (pull_request) Successful in 55s
CI / quality (pull_request) Successful in 1m9s
CI / unit_tests (pull_request) Failing after 1m19s
CI / typecheck (pull_request) Successful in 1m31s
CI / security (pull_request) Successful in 1m37s
CI / coverage (pull_request) Has been skipped
CI / docker (pull_request) Has been skipped
CI / integration_tests (pull_request) Successful in 4m3s
CI / e2e_tests (pull_request) Failing after 4m29s
CI / status-check (pull_request) Failing after 3s
CI / benchmark-regression (pull_request) Failing after 1m15s
fix(security): replace string-prefix path containment with semantic is_relative_to — closes startswith bypass #7478 (#11002)
Replace str(path).startswith(str(root)) with Path.is_relative_to() in three
file-operation validation functions across the platform:

- file_ops.validate_sandbox_path()  (was: string startswith check)
- inline_executor._validate_paths() (was: string startswith check)
- file_tools.validate_path()        (added documentation reinforcing relative_to)

The vulnerability allowed sandbox prefix bypasses — e.g., a sandbox at
/tmp/sandbox would incorrectly accept /tmp/sandbox_evil/shell.py because
the target string happens to start with the root string. Path.is_relative_to()
uses semantic path containment comparison and correctly rejects such paths
regardless of naming coincidences.

Per docs/specification.md (line 46394): all path containment checks MUST use
Path.is_relative_to(root) or equivalent — never string prefix comparison.

ISSUES CLOSED: #7478
2026-05-08 08:04:29 +00:00
..