{"record":{"id":"e46a2ecabf63d0fe","repo":"ruvnet/ruflo","slug":"code-path-traversal","errorCode":"CODE_PATH_TRAVERSAL","errorMessage":"Path traversal detected","messagePattern":"Path traversal detected","errorType":"validation","errorClass":"CodeIntelligenceError","httpStatus":null,"severity":"error","filePath":"v3/plugins/code-intelligence/src/mcp-tools.ts","lineNumber":101,"sourceCode":" */\nexport interface MCPToolResult<T = unknown> {\n  content: Array<{ type: 'text'; text: string }>;\n  data?: T;\n}\n\n// ============================================================================\n// Security Utilities\n// ============================================================================\n\n/**\n * Validate path for security\n */\nfunction validatePath(userPath: string, allowedRoots: string[]): string {\n  const normalized = path.normalize(userPath);\n\n  // Check for path traversal\n  if (normalized.includes('..')) {\n    throw new CodeIntelligenceError(\n      CodeIntelligenceErrorCodes.PATH_TRAVERSAL,\n      'Path traversal detected',\n      { path: userPath }\n    );\n  }\n\n  // Check against allowed roots\n  const resolved = path.resolve(normalized);\n  const isAllowed = allowedRoots.some(root => {\n    const resolvedRoot = path.resolve(root);\n    return resolved.startsWith(resolvedRoot);\n  });\n\n  if (!isAllowed && allowedRoots.length > 0 && !allowedRoots.includes('.')) {\n    throw new CodeIntelligenceError(\n      CodeIntelligenceErrorCodes.PATH_TRAVERSAL,\n      'Path outside allowed roots',\n      { path: userPath, allowedRoots }","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/plugins/code-intelligence/src/mcp-tools.ts#L83-L119","documentation":"Security guard in validatePath: after normalization the user-supplied path contains '..', i.e. it can climb out of the allowed roots. The path is rejected with the PATH_TRAVERSAL error code before any tool reads the filesystem; used by every code-intelligence tool that takes a path.","triggerScenarios":"Thrown at v3/plugins/code-intelligence/src/mcp-tools.ts:101 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sanitize and normalize the input path, rejecting '..' segments and absolute paths outside the allowed root.","Resolve the path against the configured base directory and verify the result stays within it before use."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}