From 59bb3880206b03349e4a39e585bbabd63b68b22d Mon Sep 17 00:00:00 2001 From: Yohanes Date: Fri, 28 Aug 2026 12:49:39 +0800 Subject: [PATCH] fix(filesystem): reject Windows paths on POSIX --- src/filesystem/__tests__/lib.test.ts | 7 +++++++ src/filesystem/lib.ts | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/src/filesystem/__tests__/lib.test.ts b/src/filesystem/__tests__/lib.test.ts index 1da741f0b0..feded1afdc 100644 --- a/src/filesystem/__tests__/lib.test.ts +++ b/src/filesystem/__tests__/lib.test.ts @@ -155,6 +155,13 @@ describe('Lib Functions', () => { describe('Security & Validation Functions', () => { describe('validatePath', () => { + it('rejects Windows drive paths on POSIX hosts', async () => { + if (process.platform === 'win32') return; + + await expect(validatePath('C:\\Users\\me\\notes\\file.md')) + .rejects.toThrow('Windows-style path received on a POSIX host'); + }); + // Use Windows-compatible paths for testing const allowedDirs = process.platform === 'win32' ? ['C:\\Users\\test', 'C:\\temp'] : ['/home/user', '/tmp']; diff --git a/src/filesystem/lib.ts b/src/filesystem/lib.ts index a1c6f04b67..1195383bea 100644 --- a/src/filesystem/lib.ts +++ b/src/filesystem/lib.ts @@ -98,6 +98,12 @@ function resolveRelativePathAgainstAllowedDirectories(relativePath: string): str // Security & Validation Functions export async function validatePath(requestedPath: string): Promise { const expandedPath = expandHome(requestedPath); + // Do not silently reinterpret a Windows drive path as a relative POSIX path. + // This would create a literal filename such as `C:\\Users\\...` inside the + // allowed root and report success for the wrong location. + if (process.platform !== 'win32' && /^(?:[A-Za-z]:)(?:[\\/]|$)/.test(expandedPath)) { + throw new Error(`Access denied - Windows-style path received on a POSIX host: ${requestedPath}`); + } const absolute = path.isAbsolute(expandedPath) ? path.resolve(expandedPath) : resolveRelativePathAgainstAllowedDirectories(expandedPath);