fix: use validate_allowed_path in FileEditor.replace_code_block() for security

Author: wangjichao

codebase_rag/tools/file_editor.py

@@ -16,6 +16,7 @@
 from ..parser_loader import load_parsers
 from ..schemas import EditResult
 from ..types_defs import FunctionMatch
+from ..utils.path_utils import validate_allowed_path
 from . import tool_descriptions as td
 
 
@@ -212,8 +213,9 @@ def replace_code_block(
 
         logger.info(ls.TOOL_FILE_EDIT_SURGICAL.format(path=file_path))
         try:
-            full_path = (self.project_root / file_path).resolve()
-            full_path.relative_to(self.project_root)
+            full_path = validate_allowed_path(
+                file_path, self.project_root, self.allowed_roots
+            )
 
             if not full_path.is_file():
                 logger.error(ls.EDITOR_FILE_NOT_FOUND.format(path=file_path))
@@ -251,7 +253,7 @@ def replace_code_block(
             logger.success(ls.TOOL_FILE_EDIT_SURGICAL_SUCCESS.format(path=file_path))
             return True
 
-        except ValueError:
+        except PermissionError:
             logger.error(ls.FILE_OUTSIDE_ROOT.format(action=cs.FileAction.EDIT))
             return False
         except Exception as e: