🛡️ Sentinel: [CRITICAL/HIGH] Fix path traversal#280
Conversation
Co-authored-by: bashandbone <89049923+bashandbone@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideAdjusts manual path resolution in the TypeScript dependency extractor to prevent directory traversal escapes and documents the vulnerability and fix in a Sentinel note. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="crates/flow/src/incremental/extractors/typescript.rs" line_range="811-817" />
<code_context>
match component {
std::path::Component::ParentDir => {
- components.pop();
+ let last = components.last();
+ match last {
+ Some(std::path::Component::RootDir)
+ | Some(std::path::Component::Prefix(_)) => {
+ // Do not pop RootDir or Prefix to prevent traversal escapes
+ }
+ Some(std::path::Component::ParentDir) | None => {
+ components.push(component);
+ }
</code_context>
<issue_to_address>
**🚨 question (security):** Re-check intended behavior for leading `..` components when normalizing paths.
Because `pop()` on an empty `components` was a no-op, leading `ParentDir` segments were previously discarded. Now, when `last` is `None`, they are preserved (e.g. `../foo` remains `../foo`). If this function is used as part of a security boundary (e.g., to enforce confinement under a root), preserving leading `..` could reintroduce traversal concerns. Please confirm whether callers rely on this to yield a path guaranteed under a root, or whether leading `..` is expected and validated elsewhere.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| let last = components.last(); | ||
| match last { | ||
| Some(std::path::Component::RootDir) | ||
| | Some(std::path::Component::Prefix(_)) => { | ||
| // Do not pop RootDir or Prefix to prevent traversal escapes | ||
| } | ||
| Some(std::path::Component::ParentDir) | None => { |
There was a problem hiding this comment.
🚨 question (security): Re-check intended behavior for leading .. components when normalizing paths.
Because pop() on an empty components was a no-op, leading ParentDir segments were previously discarded. Now, when last is None, they are preserved (e.g. ../foo remains ../foo). If this function is used as part of a security boundary (e.g., to enforce confinement under a root), preserving leading .. could reintroduce traversal concerns. Please confirm whether callers rely on this to yield a path guaranteed under a root, or whether leading .. is expected and validated elsewhere.
There was a problem hiding this comment.
Pull request overview
This PR hardens TypeScript module path normalization in the incremental dependency extractor and adds a Sentinel note documenting the path traversal issue and mitigation.
Changes:
- Updates manual
ParentDirhandling to avoid popping root/prefix components and to preserve leading..components. - Documents the vulnerability, learning, and prevention guidance in
.jules/sentinel.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
crates/flow/src/incremental/extractors/typescript.rs |
Adjusts unresolved path component normalization for TypeScript/JavaScript imports. |
.jules/sentinel.md |
Adds a security note describing the path traversal remediation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| std::path::Component::ParentDir => { | ||
| components.pop(); | ||
| let last = components.last(); | ||
| match last { | ||
| Some(std::path::Component::RootDir) | ||
| | Some(std::path::Component::Prefix(_)) => { | ||
| // Do not pop RootDir or Prefix to prevent traversal escapes | ||
| } | ||
| Some(std::path::Component::ParentDir) | None => { | ||
| components.push(component); | ||
| } | ||
| _ => { | ||
| components.pop(); | ||
| } | ||
| } |
Component::ParentDiraccording to security guidelines.PR created automatically by Jules for task 10333070984827272800 started by @bashandbone
Summary by Sourcery
Harden manual path resolution in the TypeScript dependency extractor to prevent path traversal escapes and document the vulnerability and remediation steps.
Bug Fixes:
Component::ParentDirfrom popping root or prefix components during manual path resolution to avoid directory traversal outside the allowed base path.Documentation:
ParentDircomponents.