{"record":{"id":"6f912a83cbcda743","repo":"ruvnet/ruflo","slug":"access-to-system-paths-is-not-allowed","errorCode":null,"errorMessage":"Access to system paths is not allowed","messagePattern":"Access to system paths is not allowed","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/mcp/src/resource-registry.ts","lineNumber":502,"sourceCode":"\n  const handler: ResourceHandler = async () => {\n    const fs = await import('fs/promises');\n    const path = await import('path');\n\n    // SECURITY: Normalize and validate the path\n    const normalizedPath = path.normalize(filePath);\n\n    // Prevent path traversal\n    if (normalizedPath.includes('..') || normalizedPath.includes('\\0')) {\n      throw new Error('Invalid file path: path traversal detected');\n    }\n\n    // Prevent access to sensitive system paths\n    const blockedPaths = ['/etc/', '/proc/', '/sys/', '/dev/', '/root/', '/var/log/'];\n    const lowerPath = normalizedPath.toLowerCase();\n    for (const blocked of blockedPaths) {\n      if (lowerPath.startsWith(blocked) || lowerPath.includes('/.')) {\n        throw new Error('Access to system paths is not allowed');\n      }\n    }\n\n    // If allowedBasePaths specified, validate against them\n    if (options?.allowedBasePaths && options.allowedBasePaths.length > 0) {\n      const resolvedPath = path.resolve(normalizedPath);\n      const isAllowed = options.allowedBasePaths.some((basePath) => {\n        const resolvedBase = path.resolve(basePath);\n        return resolvedPath.startsWith(resolvedBase);\n      });\n\n      if (!isAllowed) {\n        throw new Error('File path is outside allowed directories');\n      }\n    }\n\n    const content = await fs.readFile(normalizedPath);\n    return [","sourceCodeStart":484,"sourceCodeEnd":520,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/mcp/src/resource-registry.ts#L484-L520","documentation":"Security guard in the file-resource handler: the normalized lowercased path starts with one of the blocked system prefixes (/etc/, /proc/, /sys/, /dev/, /root/, /var/log/) or contains a dot-directory component ('/.'). File resources may not expose sensitive system locations.","triggerScenarios":"Thrown at v3/@claude-flow/mcp/src/resource-registry.ts:502 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Request paths inside the allowed workspace roots only; system paths (e.g. /etc, /proc) are blocked by policy.","If access is legitimate, adjust the allowed-roots configuration rather than bypassing the check."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}