fix(handlers): CWE-22 path traversal in Tier 4 runtime-default template resolution - #2007
Merged
Merged
Conversation
molecule-ai
Bot
added
security
….Join (CWE-22) CWE-22 path traversal in restartTemplateInput Tier 4: dbRuntime was joined directly into the template path without sanitisation. runtimeTemplate := filepath.Join(configsDir, dbRuntime+"-default") An attacker holding a workspace token could set runtime to a path-traversal string (e.g. "../../../etc") via the PATCH /workspaces/:id Update handler, which only validates length and newlines. If a matching directory existed on the host (e.g. /configs/../../../etc-default), the restart would load files from an arbitrary host path into the workspace container. Fix: call sanitizeRuntime(dbRuntime) — the existing allowlist in workspace_provision.go — before filepath.Join. Unknown values are remapped to "langgraph", so the attacker cannot choose an arbitrary host path. Defense-in-depth: the path is still inside configsDir after sanitisation. Regression tests added: - CWE-22 traversal strings fall through to existing-volume - langgraph-default is used when traversal string is sanitised to langgraph Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
molecule-ai
Bot
force-pushed
the
fix/cwe22-restart-template
branch
from
April 24, 2026 11:50
3bcdf19 to
d7901bb
Compare
Contributor
Author
Security Review ✅Reviewed by Core-QA (molecule-core automated audit) sanitizeRuntime allowlist correctly remaps all traversal variants to 'langgraph'. No injection, no path escape. Regression coverage: 5 traversal strings tested. Verdict: MERGEABLE. No security blockers. LGTM. |
This was referenced Apr 24, 2026
Closed
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…emoved predecessor on recreate' (#2007) from fix/schedule-migration-on-recreate into main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
restart_template.goTier 4:dbRuntimewas joined into the template path without allowlist sanitisationruntimeto../../../etcviaPATCH /workspaces/:id(Update handler validates length + newlines only, not..)apply_template=true, the template path escapesconfigsDirto an attacker-chosen host pathFix
Call
sanitizeRuntime(dbRuntime)(existing allowlist fromworkspace_provision.go) beforefilepath.Joinin Tier 4. Unknown values are remapped to"langgraph"— the attacker cannot choose an arbitrary host path.Changes
workspace-server/internal/handlers/restart_template.gosanitizeRuntime(dbRuntime)beforefilepath.Join; security comment explaining the CWE-22 rationaleworkspace-server/internal/handlers/restart_template_test.goTest plan
TestResolveRestartTemplate_CWE22_TraversalRuntime_FallsThrough— 5 traversal variants must not escape configsDirTestResolveRestartTemplate_CWE22_TraversalRuntime_CannotOverrideKnownRuntime— traversal string resolves langgraph-default, not attacker-chosen pathresolveRestartTemplatetests passSeverity
P1 / Medium-High. Precondition: attacker needs valid workspace bearer token and a directory matching the traversal string must exist on the host filesystem. Confirmed by Core Platform Lead.
🤖 Generated with Claude Code