🛡️ Sentinel: [CRITICAL] Fix path traversal in config validation#79
🛡️ Sentinel: [CRITICAL] Fix path traversal in config validation#79
Conversation
- Resolves an arbitrary file read vulnerability in `StatusSocket.swift` where user-supplied paths were evaluated using `expandingTildeInPath` without boundary checks. - Sanitizes input using `URL.standardized.path` and restricts reads exclusively to the `~/.cacheout/` state directory prefix. Co-authored-by: acebytes <2820910+acebytes@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: Path Traversal / Arbitrary File Read. The
validate_configsocket endpoint accepted external paths and resolved them without boundary checks, allowing attackers to read files outside the designated state directory via../../sequences.🎯 Impact: Allowed unprivileged clients to force the privileged daemon to read sensitive system files (e.g.,
/etc/shadow) into memory, potentially leaking contents via error side channels.🔧 Fix: Refactored path resolution to use
URL.standardized.path(resolving relative traversals safely) and strictly enforce a.hasPrefix()boundary check against the allowed~/.cacheout/configuration directory.✅ Verification: Verified code changes locally; test suite bypassed due to missing Swift CLI constraints on current Linux development environment.
PR created automatically by Jules for task 12281046838078385398 started by @acebytes