From dc545dd61337904e26e18e5e5bed190675432406 Mon Sep 17 00:00:00 2001 From: Anso Date: Wed, 1 Apr 2026 19:25:14 -0400 Subject: [PATCH] fix(security): prevent path traversal via env_file resolution (#311) Validate that resolved env_file paths stay within the stack directory before adding them to the allowed list. Uses the existing isPathWithinBase utility to reject any path that escapes the boundary. --- backend/src/index.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/src/index.ts b/backend/src/index.ts index 1878502a..2c8845de 100644 --- a/backend/src/index.ts +++ b/backend/src/index.ts @@ -31,7 +31,7 @@ import { SSOService } from './services/SSOService'; import { SchedulerService } from './services/SchedulerService'; import { RegistryService } from './services/RegistryService'; import { CronExpressionParser } from 'cron-parser'; -import { isValidStackName, isValidRemoteUrl } from './utils/validation'; +import { isValidStackName, isValidRemoteUrl, isPathWithinBase } from './utils/validation'; import YAML from 'yaml'; import fs, { promises as fsPromises } from 'fs'; @@ -2512,6 +2512,7 @@ async function resolveAllEnvFilePaths(nodeId: number, stackName: string): Promis const addEnvPath = (rawPath: string) => { const resolved = path.resolve(stackDir, rawPath); + if (!isPathWithinBase(resolved, stackDir)) return; envFiles.add(resolved); };