fix(refs): prevent out-of-root file reads from index

Author: PatrickSys

src/core/symbol-references.ts

@@ -68,16 +68,25 @@ function buildPreviewFromFileLines(lines: string[], line: number): string {
 }
 
 function resolveAbsoluteChunkPath(rootPath: string, chunk: IndexedChunk): string | null {
+  const resolvedRoot = path.resolve(rootPath);
+  const isWithinRoot = (candidate: string): boolean => {
+    const resolvedCandidate = path.resolve(candidate);
+    const relative = path.relative(resolvedRoot, resolvedCandidate);
+    return Boolean(relative) && !relative.startsWith('..') && !path.isAbsolute(relative);
+  };
+
   if (typeof chunk.filePath === 'string' && chunk.filePath.trim()) {
     const raw = chunk.filePath.trim();
     if (path.isAbsolute(raw)) {
-      return raw;
+      return isWithinRoot(raw) ? raw : null;
     }
-    return path.resolve(rootPath, raw);
+    const resolved = path.resolve(resolvedRoot, raw);
+    return isWithinRoot(resolved) ? resolved : null;
   }
 
   if (typeof chunk.relativePath === 'string' && chunk.relativePath.trim()) {
-    return path.resolve(rootPath, chunk.relativePath.trim());
+    const resolved = path.resolve(resolvedRoot, chunk.relativePath.trim());
+    return isWithinRoot(resolved) ? resolved : null;
   }
 
   return null;

tests/get-symbol-references.test.ts

@@ -10,6 +10,30 @@ import {
   KEYWORD_INDEX_FILENAME
 } from '../src/constants/codebase-context.js';
 
+type ToolCallRequest = {
+  jsonrpc: '2.0';
+  id: number;
+  method: 'tools/call';
+  params: { name: string; arguments: Record<string, unknown> };
+};
+
+type ToolCallResponse = {
+  content: Array<{ type: 'text'; text: string }>;
+  isError?: boolean;
+};
+
+function getToolCallHandler(server: unknown): (request: ToolCallRequest) => Promise<ToolCallResponse> {
+  const handlers = (server as { _requestHandlers?: unknown })._requestHandlers;
+  if (!(handlers instanceof Map)) {
+    throw new Error('Expected server._requestHandlers to be a Map');
+  }
+  const handler = handlers.get('tools/call');
+  if (typeof handler !== 'function') {
+    throw new Error('Expected tools/call handler to be registered');
+  }
+  return handler as (request: ToolCallRequest) => Promise<ToolCallResponse>;
+}
+
 describe('get_symbol_references MCP tool', () => {
   let tempRoot: string | null = null;
   let originalArgv: string[] | null = null;
@@ -106,7 +130,7 @@ describe('get_symbol_references MCP tool', () => {
     );
 
     const { server } = await import('../src/index.js');
-    const handler = (server as any)._requestHandlers.get('tools/call');
+    const handler = getToolCallHandler(server);
 
     const response = await handler({
       jsonrpc: '2.0',
@@ -202,7 +226,7 @@ describe('get_symbol_references MCP tool', () => {
     );
 
     const { server } = await import('../src/index.js');
-    const handler = (server as any)._requestHandlers.get('tools/call');
+    const handler = getToolCallHandler(server);
 
     const response = await handler({
       jsonrpc: '2.0',
@@ -283,7 +307,7 @@ describe('get_symbol_references MCP tool', () => {
     );
 
     const { server } = await import('../src/index.js');
-    const handler = (server as any)._requestHandlers.get('tools/call');
+    const handler = getToolCallHandler(server);
 
     const response = await handler({
       jsonrpc: '2.0',
@@ -362,7 +386,7 @@ describe('get_symbol_references MCP tool', () => {
     );
 
     const { server } = await import('../src/index.js');
-    const handler = (server as any)._requestHandlers.get('tools/call');
+    const handler = getToolCallHandler(server);
 
     const response = await handler({
       jsonrpc: '2.0',