The code checks strstr(disk_path, "..") != NULL to block path traversal in three places (file.c:212-213, 220-221, 236-237, and 460-461). This is a weak check:
On some systems, unicode normalization can bypass it
Symlinks within the allowed path can indirectly traverse
A path like /foo/..bar/file contains ".." but is not traversal — this causes false positives
The check does not catch all encoding-based traversal attempts
An attacker sends a crafted file path that bypasses the substring check. If successful, files can be written outside the destination directory.
Suggested Fix
Use realpath() to canonicalize the destination path and verify it starts with the root directory. Before that, the received path should be checked character-by-character to reject any path component that is exactly ".." (not substring).
Expected impact
Prevents arbitrary file write outside the destination directory.
Severity
high
Category
security
Sub-Agent
security-screener (SC-1)
This issue was automatically generated by the issue-creator agent.
## Description
The code checks `strstr(disk_path, "..") != NULL` to block path traversal in three places (`file.c:212-213`, `220-221`, `236-237`, and `460-461`). This is a weak check:
- On some systems, unicode normalization can bypass it
- Symlinks within the allowed path can indirectly traverse
- A path like `/foo/..bar/file` contains ".." but is not traversal — this causes false positives
- The check does not catch all encoding-based traversal attempts
## Location
src/shared/file.c:212-213, 220-221, 236-237, 460-461
## How to trigger
An attacker sends a crafted file path that bypasses the substring check. If successful, files can be written outside the destination directory.
## Suggested Fix
Use `realpath()` to canonicalize the destination path and verify it starts with the root directory. Before that, the received path should be checked character-by-character to reject any path component that is exactly ".." (not substring).
## Expected impact
Prevents arbitrary file write outside the destination directory.
## Severity
high
## Category
security
## Sub-Agent
security-screener (SC-1)
---
_This issue was automatically generated by the issue-creator agent._
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Description
The code checks
strstr(disk_path, "..") != NULLto block path traversal in three places (file.c:212-213,220-221,236-237, and460-461). This is a weak check:/foo/..bar/filecontains ".." but is not traversal — this causes false positivesLocation
src/shared/file.c:212-213, 220-221, 236-237, 460-461
How to trigger
An attacker sends a crafted file path that bypasses the substring check. If successful, files can be written outside the destination directory.
Suggested Fix
Use
realpath()to canonicalize the destination path and verify it starts with the root directory. Before that, the received path should be checked character-by-character to reject any path component that is exactly ".." (not substring).Expected impact
Prevents arbitrary file write outside the destination directory.
Severity
high
Category
security
Sub-Agent
security-screener (SC-1)
This issue was automatically generated by the issue-creator agent.
Fixed in PR #148 — merged into main on 2026-07-29. See #148