@@ -667,52 +667,54 @@ def filter_functions(
667667
668668 def _validate_path_no_traversal (path : Path | str ) -> bool :
669669 """Validate that a path does not contain path traversal components.
670-
670+
671671 This prevents path traversal attacks by rejecting paths with '..' components.
672672 Paths passed to this function should be from trusted sources (git operations,
673673 file system discovery), but we validate defensively.
674-
674+
675675 Args:
676676 path: Path to validate
677-
677+
678678 Returns:
679679 True if path is safe (no traversal components), False otherwise
680+
680681 """
681682 path_str = str (path )
682683 # Check for path traversal attempts
683- if ".." in path_str :
684- return False
685684 # Check for absolute paths that might escape (additional safety check)
686685 # Note: We allow absolute paths as they're needed for worktree paths
687- return True
686+ return ".." not in path_str
688687
689688 def _resolve_path (path : Path | str ) -> Path :
690689 # Use strict=False so we don't fail on paths that don't exist yet (e.g. worktree paths)
691690 # SECURITY: Validate path before resolution to prevent traversal attacks
692691 if not _validate_path_no_traversal (path ):
693- raise ValueError (f"Path contains traversal components: { path } " )
692+ error_msg = f"Path contains traversal components: { path } "
693+ raise ValueError (error_msg )
694694 return Path (path ).resolve (strict = False )
695695
696696 def _resolve_path_consistent (path : Path | str ) -> Path :
697697 """Resolve path consistently: use strict resolution if path exists, otherwise non-strict.
698-
698+
699699 SECURITY: This function validates paths to prevent traversal attacks before resolution.
700700 Paths should come from trusted sources (git operations, file system discovery),
701701 but we validate defensively.
702-
702+
703703 Args:
704704 path: Path to resolve (from trusted sources like git diff or file discovery)
705-
705+
706706 Returns:
707707 Resolved absolute Path
708-
708+
709709 Raises:
710710 ValueError: If path contains traversal components
711+
711712 """
712713 # SECURITY: Validate path before any resolution to prevent traversal attacks
713714 if not _validate_path_no_traversal (path ):
714- raise ValueError (f"Path contains traversal components: { path } " )
715-
715+ error_msg = f"Path contains traversal components: { path } "
716+ raise ValueError (error_msg )
717+
716718 path_obj = Path (path )
717719 if path_obj .exists ():
718720 try :
0 commit comments