{"record":{"id":"361ae0630b598485","repo":"ruvnet/ruflo","slug":"only-json-and-config-file-extensions-are-allow","errorCode":null,"errorMessage":"Only .json and .config.* file extensions are allowed","messagePattern":"Only \\.json and \\.config\\.\\* file extensions are allowed","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/mcp/tools/config-tools.ts","lineNumber":35,"sourceCode":" * Validate and sanitize config file path to prevent path traversal\n */\nfunction validateConfigPath(inputPath: string, cwd: string = process.cwd()): string {\n  // Normalize the path to resolve .. and .\n  const normalizedPath = normalize(inputPath);\n\n  // Block absolute paths and paths with traversal\n  if (normalizedPath.startsWith('/') || normalizedPath.startsWith('\\\\')) {\n    throw new Error('Absolute paths are not allowed for config files');\n  }\n  if (normalizedPath.includes('..')) {\n    throw new Error('Path traversal (..) is not allowed');\n  }\n\n  // Only allow .json and .config.* files\n  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];\n  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));\n  if (!hasAllowedExt) {\n    throw new Error('Only .json and .config.* file extensions are allowed');\n  }\n\n  // Resolve to absolute path within cwd\n  const resolvedPath = resolve(cwd, normalizedPath);\n\n  // Ensure the resolved path is within cwd\n  if (!resolvedPath.startsWith(cwd)) {\n    throw new Error('Config path must be within current working directory');\n  }\n\n  return resolvedPath;\n}\n\n// ============================================================================\n// Input Schemas\n// ============================================================================\n\nconst loadConfigSchema = z.object({","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/mcp/tools/config-tools.ts#L17-L53","documentation":"validateConfigPath extension guard: the (path- and traversal-safe) filename does not end in .json, .config.json, .config.js, or .config.ts. Only these config file formats may be read/written by the config tools, so other extensions are refused at validation time.","triggerScenarios":"Thrown at v3/mcp/tools/config-tools.ts:35 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a .json or .config.* file extension for the config file.","Rename the file or adjust the tool call to target an allowed extension."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}