[Security] Prevent absolute path bypass in sanitizeRelativePath#7550
[Security] Prevent absolute path bypass in sanitizeRelativePath#7550gonzaloriestra wants to merge 4 commits into
Conversation
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
d961a00 to
86c75fc
Compare
Enhance sanitizeRelativePath to strip leading slashes and Windows drive letters, ensuring paths are strictly relative. Add unit tests to verify cross-platform safety.
Enhance sanitizeRelativePath to strip leading slashes and Windows drive letters, ensuring paths are strictly relative and cross-platform safe. Improve warning messages to accurately describe the security risk. Add unit tests for various traversal and absolute path scenarios.
86c75fc to
6312bb7
Compare
Enhance sanitizeRelativePath to strip leading slashes and Windows drive letters, ensuring paths are strictly relative and cross-platform safe. Improve warning messages to accurately describe the security risk. Add unit tests for various traversal and absolute path scenarios. Fix Prettier formatting issue.
Enhance sanitizeRelativePath to strip leading slashes and Windows drive letters, ensuring paths are strictly relative and cross-platform safe. Improve warning messages to accurately describe the security risk. Add unit tests for various traversal and absolute path scenarios. Fix Prettier formatting issue.
Differences in type declarationsWe detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:
New type declarationsWe found no new type declarations in this PR Existing type declarationspackages/cli-kit/dist/public/node/hooks/postrun.d.ts@@ -1,3 +1,7 @@
+/**
+ * Postrun hook — uses dynamic imports to avoid loading heavy modules (base-command, analytics)
+ * at module evaluation time. These are only needed after the command has already finished.
+ */
import { Hook } from '@oclif/core';
/**
* Check if post run hook has completed.
@@ -5,21 +9,6 @@ import { Hook } from '@oclif/core';
* @returns Whether post run hook has completed.
*/
export declare function postRunHookHasCompleted(): boolean;
-/**
- * Wait for the postrun hook to finish (so auto-upgrade has a chance to run) and then
- * tree-kill the current process tree before exiting.
- *
- * Long-running interactive commands like need this when the user terminates
- * the command via or Ctrl+C. The dev sub-processes such as servers and watchers keep
- * the event loop alive, so even after oclif's postrun hook completes the node process
- * won't exit on its own and we have to the process tree. We must not do that
- * before the postrun hook has actually finished running auto-upgrade, otherwise we would
- * kill the upgrade mid-way while is still running.
- *
- * The flag is flipped at the very end of the hook after
- * resolves, so polling it here is safe.
- */
-export declare function waitForPostRunHookAndExit(): void;
export declare const hook: Hook.Postrun;
/**
* Auto-upgrades the CLI after a command completes, if a newer version is available.
packages/cli-kit/dist/private/node/ui/components/AutocompletePrompt.d.ts@@ -20,13 +20,6 @@ export interface AutocompletePromptProps<T> {
abortSignal?: AbortSignal;
infoMessage?: InfoMessageProps['message'];
groupOrder?: string[];
- /**
- * Throttle window in milliseconds applied to the search callback. Defaults to 400ms,
- * which is appropriate for remote/paginated backends. In-memory consumers (where the
- * search callback resolves synchronously) can pass 0 for instant filtering on every
- * keystroke.
- */
- searchDebounceMs?: number;
}
-declare function AutocompletePrompt<T>({ message, choices, infoTable, onSubmit, search, hasMorePages: initialHasMorePages, abortSignal, infoMessage, groupOrder, searchDebounceMs, }: React.PropsWithChildren<AutocompletePromptProps<T>>): ReactElement | null;
+declare function AutocompletePrompt<T>({ message, choices, infoTable, onSubmit, search, hasMorePages: initialHasMorePages, abortSignal, infoMessage, groupOrder, }: React.PropsWithChildren<AutocompletePromptProps<T>>): ReactElement | null;
export { AutocompletePrompt };
\ No newline at end of file
|
WHY are these changes introduced?
The
sanitizeRelativePathfunction is intended to ensure a path provided by a user (e.g., in a configuration file) is relative and does not escape the intended directory. Previously, it only checked for..segments but allowed absolute paths (starting with/or Windows drive letters likeC:\) to pass through. This could allow an attacker to overwrite sensitive system files if the path is used as a destination in a file operation.WHAT is this pull request doing?
sanitizeRelativePathto detect and strip leading forward slashes and Windows drive letters.packages/cli-kit/src/public/node/path.test.tsto verify the fix across different OS path styles.How to test your changes?
You can verify the behavior by calling the
sanitizeRelativePathfunction with various inputs in a Node environment or via unit tests.Duplicate check
gh pr list --repo Shopify/cli --state all --limit 200 --search 'label:"Jules" "Security" in:title' --json number,title,state,url,body,files[Security] Redact cookies in sanitized headers output(Different subsystem, unrelated to path sanitization).Checklist
PR created automatically by Jules for task 7639287056760175654 started by @gonzaloriestra