d0zingcat/claude-code
1
0
Fork 0
mirror of https://github.com/instructkr/claude-code.git synced 2026-05-30 17:26:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(claw-analog): reject backslash paths in validate_rel_path (dotdot bypass on Linux)

Browse Source
This commit is contained in:
YeonGyu-Kim
2026-05-25 12:41:32 +09:00
parent 1f572ff8de
commit 06c126ab6b
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
rust/crates/claw-analog/src/lib.rs
View File

@@ -1589,6 +1589,12 @@ fn output_to_input_blocks(blocks: &[OutputContentBlock]) -> Vec<InputContentBloc
} }
pub fn validate_rel_path(rel: &str) -> Result<(), String> { pub fn validate_rel_path(rel: &str) -> Result<(), String> {
// Reject Windows-style backslash paths that may contain dotdot traversal
// (on Unix, Path::components does not split on backslash, so "..\\x" parses
// as a single Normal component and evades the ParentDir check).
if rel.contains('\\') {
return Err("path must not contain backslashes".into());
}
let p = Path::new(rel); let p = Path::new(rel);
for c in p.components() { for c in p.components() {
match c { match c {