fix(security): resolve symlinks in workspace boundary check (#169)

isPathOutsideWorkspace() only normalized ./.. so a symlink living inside the
workspace but pointing outside passed the check, trivially bypassing the
out-of-workspace read protection. Resolve the real path (following symlinks)
for both the target and the workspace folders before comparing. Paths that
don't exist yet resolve via their nearest existing ancestor.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: proyectoauraorg

src/utils/__tests__/pathUtils.spec.ts

@@ -0,0 +1,79 @@
+import * as fs from "fs"
+import * as os from "os"
+import * as path from "path"
+
+import { isPathOutsideWorkspace } from "../pathUtils"
+
+// Mutable workspaceFolders the mocked vscode module reads from.
+const { mockWorkspace } = vi.hoisted(() => ({
+	mockWorkspace: { folders: [] as Array<{ uri: { fsPath: string } }> },
+}))
+
+vi.mock("vscode", () => ({
+	workspace: {
+		get workspaceFolders() {
+			return mockWorkspace.folders.length > 0 ? mockWorkspace.folders : undefined
+		},
+	},
+}))
+
+describe("isPathOutsideWorkspace", () => {
+	let tmpRoot: string
+	let workspaceDir: string
+	let outsideDir: string
+
+	beforeEach(() => {
+		// realpath the tmp dir because macOS resolves /var -> /private/var
+		tmpRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "zoo-pathutils-")))
+		workspaceDir = path.join(tmpRoot, "workspace")
+		outsideDir = path.join(tmpRoot, "outside")
+		fs.mkdirSync(workspaceDir)
+		fs.mkdirSync(outsideDir)
+		mockWorkspace.folders = [{ uri: { fsPath: workspaceDir } }]
+	})
+
+	afterEach(() => {
+		mockWorkspace.folders = []
+		fs.rmSync(tmpRoot, { recursive: true, force: true })
+	})
+
+	it("treats a real file inside the workspace as inside", () => {
+		const inside = path.join(workspaceDir, "file.ts")
+		fs.writeFileSync(inside, "x")
+		expect(isPathOutsideWorkspace(inside)).toBe(false)
+	})
+
+	it("treats a real file outside the workspace as outside", () => {
+		const outside = path.join(outsideDir, "secret.txt")
+		fs.writeFileSync(outside, "secret")
+		expect(isPathOutsideWorkspace(outside)).toBe(true)
+	})
+
+	it("treats a not-yet-existing file inside the workspace as inside", () => {
+		// File about to be created — realpath of the parent (workspace) still resolves.
+		expect(isPathOutsideWorkspace(path.join(workspaceDir, "new-file.ts"))).toBe(false)
+	})
+
+	it("treats a symlink inside the workspace that points outside as OUTSIDE (#169)", () => {
+		const secret = path.join(outsideDir, "secret.txt")
+		fs.writeFileSync(secret, "secret")
+		const link = path.join(workspaceDir, "link-to-secret.txt")
+		fs.symlinkSync(secret, link)
+
+		// Lexically the link lives inside the workspace, but it resolves outside.
+		expect(isPathOutsideWorkspace(link)).toBe(true)
+	})
+
+	it("treats a symlinked directory inside the workspace that points outside as OUTSIDE (#169)", () => {
+		fs.writeFileSync(path.join(outsideDir, "deep.txt"), "secret")
+		const linkDir = path.join(workspaceDir, "linked-dir")
+		fs.symlinkSync(outsideDir, linkDir)
+
+		expect(isPathOutsideWorkspace(path.join(linkDir, "deep.txt"))).toBe(true)
+	})
+
+	it("returns true when there are no workspace folders", () => {
+		mockWorkspace.folders = []
+		expect(isPathOutsideWorkspace(path.join(workspaceDir, "file.ts"))).toBe(true)
+	})
+})

src/utils/pathUtils.ts

@@ -1,5 +1,36 @@
 import * as vscode from "vscode"
 import * as path from "path"
+import * as fs from "fs"
+
+/**
+ * Resolves a path to its canonical form, following symlinks.
+ *
+ * If the path does not exist yet (e.g. a file that is about to be created), the
+ * realpath of the nearest existing ancestor is resolved and the remaining
+ * segments are re-appended. This ensures a symlink anywhere along the path is
+ * still followed, while paths that don't exist yet can still be evaluated.
+ */
+function realPathOrNearest(target: string): string {
+	let current = path.resolve(target)
+	const trailing: string[] = []
+
+	// Walk up until an existing path can be resolved, bounded by the filesystem root.
+	while (true) {
+		try {
+			const resolved = fs.realpathSync.native(current)
+			return trailing.length > 0 ? path.join(resolved, ...trailing.reverse()) : resolved
+		} catch {
+			const parent = path.dirname(current)
+			if (parent === current) {
+				// Reached the root without finding an existing path; fall back to the
+				// lexically resolved path.
+				return path.resolve(target)
+			}
+			trailing.push(path.basename(current))
+			current = parent
+		}
+	}
+}
 
 /**
  * Checks if a file path is outside all workspace folders
@@ -12,12 +43,16 @@ export function isPathOutsideWorkspace(filePath: string): boolean {
 		return true
 	}
 
-	// Normalize and resolve the path to handle .. and . components correctly
-	const absolutePath = path.resolve(filePath)
+	// Resolve symlinks (not just "." / "..") so a symlink that lives inside the
+	// workspace but points outside it is correctly treated as outside. Without
+	// this, the out-of-workspace read protection was trivially bypassed by
+	// symlinking to a file outside the workspace. See issue #169.
+	const absolutePath = realPathOrNearest(filePath)
 
 	// Check if the path is within any workspace folder
 	return !vscode.workspace.workspaceFolders.some((folder) => {
-		const folderPath = folder.uri.fsPath
+		// Resolve the workspace folder too, in case it is itself reached via a symlink.
+		const folderPath = realPathOrNearest(folder.uri.fsPath)
 		// Path is inside a workspace if it equals the workspace path or is a subfolder
 		return absolutePath === folderPath || absolutePath.startsWith(folderPath + path.sep)
 	})