feat: validate copy src paths are relative and within context directory#1106
Merged
mishushakov merged 20 commits intomainfrom Feb 5, 2026
Merged
feat: validate copy src paths are relative and within context directory#1106mishushakov merged 20 commits intomainfrom
mishushakov merged 20 commits intomainfrom
Conversation
Add path validation to the copy method in both JS and Python SDKs to ensure source paths are always relative and don't escape the context directory. This prevents: - Absolute paths like /absolute/whatever (Unix) or C:\whatever (Windows) - Path traversal attacks like ../whatever or ./foo/../../../bar The validation works cross-platform using Node's path.isAbsolute/normalize and Python's os.path.isabs/normpath plus PureWindowsPath for detecting Windows paths on Unix. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: c1a8eb9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Keep only the unit tests for validateRelativePath. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9c49e71beb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Use path.win32.isAbsolute() in addition to path.isAbsolute() to ensure Windows-style absolute paths (C:\foo, \\server\share) are rejected on all platforms, not just Windows. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The escape check now correctly distinguishes between:
- Path escapes like '../foo' (rejected)
- Valid filenames like '..myconfig' (allowed)
Changed from `startsWith('..')` to checking for '..' followed by a path
separator. Also added cross-platform Windows path escape detection using
path.win32/ntpath to catch '..\' escapes on Unix.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Remove copyAbsolute/copy_absolute entries from failure maps since the corresponding tests don't invoke the build process that uses them. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
When copyItems calls copy internally, the stack trace captured in copy points to SDK internals rather than the user's copyItems call site. Now copyItems validates all paths with its own stack trace before delegating to copy, so validation errors point to user code. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
mishushakov
force-pushed
the
mishushakov/relative-path-validation
branch
from
4543e97 to
90bb89b
Compare
jakubno
requested changes
Feb 3, 2026
Member
jakubno
left a comment
jakubno
left a comment
There was a problem hiding this comment.
This looks much better! Can we simplify it even little bit more by not doing windows path resolution on unix and vice versa?
can you add tests for the issue we had before ./a/./../../b?
Rely on Node's path.isAbsolute/normalize and Python's os.path.isabs/normpath instead of explicitly checking Windows paths on all platforms. Windows path tests now only run on Windows. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Move the repeated TracebackType construction pattern into a reusable make_traceback() function in template/utils.py, simplifying 7 call sites in main.py. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jakubno
approved these changes
Feb 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add path validation to the copy method in both JS and Python SDKs to ensure source paths are always relative and don't escape the context directory.
This prevents:
The validation works cross-platform using Node's path.isAbsolute/normalize and Python's os.path.isabs/normpath plus PureWindowsPath for detecting Windows paths on Unix.
Note
Medium Risk
Changes behavior of
copy/copy_itemsto throw earlier for previously-accepted absolute or escaping paths, which could break some consumers; logic is localized and well-covered by tests.Overview
Prevents path traversal in template
copyoperations by validatingsrcis relative and does not escape the context directory (rejects absolute paths and..-based escapes) in both the JS and Python SDKs.Updates
copyItems/copy_itemserror handling to preserve the caller’s stack trace when validation fails, adds unit coverage for the new path validator plus new stack-trace tests for absolute-path failures, and ships as patch releases via a changeset.Written by Cursor Bugbot for commit c1a8eb9. This will update automatically on new commits. Configure here.