{"record":{"id":"9d7d8e6039354893","repo":"ruvnet/ruflo","slug":"path-traversal-is-not-allowed","errorCode":null,"errorMessage":"Path traversal (..) is not allowed","messagePattern":"Path traversal \\(\\.\\.\\) is not allowed","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/mcp/tools/config-tools.ts","lineNumber":28,"sourceCode":" */\n\nimport { z } from 'zod';\nimport { MCPTool, ToolContext } from '../types.js';\nimport { resolve, normalize } from 'path';\n\n/**\n * Validate and sanitize config file path to prevent path traversal\n */\nfunction validateConfigPath(inputPath: string, cwd: string = process.cwd()): string {\n  // Normalize the path to resolve .. and .\n  const normalizedPath = normalize(inputPath);\n\n  // Block absolute paths and paths with traversal\n  if (normalizedPath.startsWith('/') || normalizedPath.startsWith('\\\\')) {\n    throw new Error('Absolute paths are not allowed for config files');\n  }\n  if (normalizedPath.includes('..')) {\n    throw new Error('Path traversal (..) is not allowed');\n  }\n\n  // Only allow .json and .config.* files\n  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];\n  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));\n  if (!hasAllowedExt) {\n    throw new Error('Only .json and .config.* file extensions are allowed');\n  }\n\n  // Resolve to absolute path within cwd\n  const resolvedPath = resolve(cwd, normalizedPath);\n\n  // Ensure the resolved path is within cwd\n  if (!resolvedPath.startsWith(cwd)) {\n    throw new Error('Config path must be within current working directory');\n  }\n\n  return resolvedPath;","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/mcp/tools/config-tools.ts#L10-L46","documentation":"validateConfigPath traversal guard: after normalization the relative path still contains '..', meaning it climbs out of the working directory (e.g. ../../etc/passwd). The escape attempt is rejected outright rather than clamped.","triggerScenarios":"Thrown at v3/mcp/tools/config-tools.ts:28 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove '..' segments from the config path.","Use paths strictly inside the project directory."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}