ruvnet/ruflo · error · CodeIntelligenceError

CODE_PATH_TRAVERSAL

CODE_PATH_TRAVERSAL

Error message

Path traversal detected

What it means

Security guard in validatePath: after normalization the user-supplied path contains '..', i.e. it can climb out of the allowed roots. The path is rejected with the PATH_TRAVERSAL error code before any tool reads the filesystem; used by every code-intelligence tool that takes a path.

Source

Thrown at v3/plugins/code-intelligence/src/mcp-tools.ts:101

 */
export interface MCPToolResult<T = unknown> {
  content: Array<{ type: 'text'; text: string }>;
  data?: T;
}

// ============================================================================
// Security Utilities
// ============================================================================

/**
 * Validate path for security
 */
function validatePath(userPath: string, allowedRoots: string[]): string {
  const normalized = path.normalize(userPath);

  // Check for path traversal
  if (normalized.includes('..')) {
    throw new CodeIntelligenceError(
      CodeIntelligenceErrorCodes.PATH_TRAVERSAL,
      'Path traversal detected',
      { path: userPath }
    );
  }

  // Check against allowed roots
  const resolved = path.resolve(normalized);
  const isAllowed = allowedRoots.some(root => {
    const resolvedRoot = path.resolve(root);
    return resolved.startsWith(resolvedRoot);
  });

  if (!isAllowed && allowedRoots.length > 0 && !allowedRoots.includes('.')) {
    throw new CodeIntelligenceError(
      CodeIntelligenceErrorCodes.PATH_TRAVERSAL,
      'Path outside allowed roots',
      { path: userPath, allowedRoots }

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Sanitize and normalize the input path, rejecting '..' segments and absolute paths outside the allowed root.
2. Resolve the path against the configured base directory and verify the result stays within it before use.

When it happens

Trigger: Thrown at v3/plugins/code-intelligence/src/mcp-tools.ts:101 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/e46a2ecabf63d0fe. Report an issue: GitHub.