[Security] Prevent path traversal in dev console assets middleware#7774
[Security] Prevent path traversal in dev console assets middleware#7774gonzaloriestra wants to merge 2 commits into
Conversation
Ensures that requested asset paths remain within the intended root directory by using `isSubpath` check. Normalizes paths using `resolvePath` to prevent bypasses via `../` segments. Added a regression test to verify the fix.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
github-actions
Bot
added
the
no-changelog
- Prevent path traversal in `devConsoleAssetsMiddleware` by validating requested paths remain within the intended root directory using `isSubpath`. - Robustify `downloadFile` by checking `res.ok`, ensuring response body exists, and properly destroying the file stream on failure to avoid race conditions during cleanup. - Add regression tests for path traversal.
1 participant
The
devConsoleAssetsMiddlewarewas vulnerable to path traversal attacks because it directly joined the user-providedassetPathwith therootDirectorywithout validating that the resulting path remained within the root. This change implements anisSubpathcheck after resolving and normalizing both paths, ensuring that attackers cannot access files outside the intended directory. A regression test was added topackages/app/src/cli/services/dev/extension/server/middlewares.test.tsto confirm the fix.PR created automatically by Jules for task 5740683100449722196 started by @gonzaloriestra