github/openclaw
1
1
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-03 03:03:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: preserve sessions path containment after legacy absolute-path normalization (#15323) (thanks @mudrii)

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-13 15:13:39 +01:00
parent abcdbd8afc
commit 0d0effd9d4
3 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/config/sessions/paths.test.ts
View File

@@ -55,6 +55,14 @@ describe("session path safety", () => {
resolveSessionFilePath("sess-1", { sessionFile: "../../etc/passwd" }, { sessionsDir }),
).toThrow(/within sessions directory/);
expect(() =>
resolveSessionFilePath(
"sess-1",
{ sessionFile: "subdir/../../escape.jsonl" },
{ sessionsDir },
),
).toThrow(/within sessions directory/);
expect(() =>
resolveSessionFilePath("sess-1", { sessionFile: "/etc/passwd" }, { sessionsDir }),
).toThrow(/within sessions directory/);

11
src/config/sessions/paths.ts
View File

@@ -77,14 +77,15 @@ function resolvePathWithinSessionsDir(sessionsDir: string, candidate: string): s
throw new Error("Session file path must not be empty");
}
const resolvedBase = path.resolve(sessionsDir);
// Normalize absolute paths that are within the sessions directory.
// Older versions stored absolute sessionFile paths in sessions.json;
// convert them to relative so the containment check passes.
// Older versions stored absolute sessionFile paths in sessions.json.
// Preserve compatibility, but validate containment against the resolved path.
const normalized = path.isAbsolute(trimmed) ? path.relative(resolvedBase, trimmed) : trimmed;
if (!normalized || normalized.startsWith("..") || path.isAbsolute(normalized)) {
const resolvedCandidate = path.resolve(resolvedBase, normalized);
const relative = path.relative(resolvedBase, resolvedCandidate);
if (!normalized || relative.startsWith("..") || path.isAbsolute(relative)) {
throw new Error("Session file path must be within sessions directory");
}
return path.resolve(resolvedBase, normalized);
return resolvedCandidate;
}
export function resolveSessionTranscriptPathInDir(