{"record":{"id":"b174a22496b37597","repo":"ruvnet/ruflo","slug":"absolute-paths-are-not-allowed-for-config-files","errorCode":null,"errorMessage":"Absolute paths are not allowed for config files","messagePattern":"Absolute paths are not allowed for config files","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"v3/mcp/tools/config-tools.ts","lineNumber":25,"sourceCode":" * - config/validate - Validate configuration\n *\n * Implements ADR-005: MCP-First API Design\n */\n\nimport { z } from 'zod';\nimport { MCPTool, ToolContext } from '../types.js';\nimport { resolve, normalize } from 'path';\n\n/**\n * Validate and sanitize config file path to prevent path traversal\n */\nfunction validateConfigPath(inputPath: string, cwd: string = process.cwd()): string {\n  // Normalize the path to resolve .. and .\n  const normalizedPath = normalize(inputPath);\n\n  // Block absolute paths and paths with traversal\n  if (normalizedPath.startsWith('/') || normalizedPath.startsWith('\\\\')) {\n    throw new Error('Absolute paths are not allowed for config files');\n  }\n  if (normalizedPath.includes('..')) {\n    throw new Error('Path traversal (..) is not allowed');\n  }\n\n  // Only allow .json and .config.* files\n  const allowedExtensions = ['.json', '.config.json', '.config.js', '.config.ts'];\n  const hasAllowedExt = allowedExtensions.some(ext => normalizedPath.endsWith(ext));\n  if (!hasAllowedExt) {\n    throw new Error('Only .json and .config.* file extensions are allowed');\n  }\n\n  // Resolve to absolute path within cwd\n  const resolvedPath = resolve(cwd, normalizedPath);\n\n  // Ensure the resolved path is within cwd\n  if (!resolvedPath.startsWith(cwd)) {\n    throw new Error('Config path must be within current working directory');","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/mcp/tools/config-tools.ts#L7-L43","documentation":"validateConfigPath normalization guard: the config file path begins with '/' or '\\\\', i.e. the caller supplied an absolute path. Config tool paths must be relative to the working directory so the file stays inside the project, so absolute inputs are rejected before any traversal checks.","triggerScenarios":"Thrown at v3/mcp/tools/config-tools.ts:25 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass a relative path within the working directory instead of an absolute path.","Resolve the path against the project root before calling the tool."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}