Skip to content
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions packages/core/src/tools/read-many-files.ts
Original file line number Diff line number Diff line change
Expand Up @@ -199,8 +199,8 @@ ${finalExclusionPatternsForDescription
const fullPath = path.join(dir, normalizedP);
let exists = false;
try {
await fsPromises.access(fullPath);
exists = true;
const st = await fsPromises.stat(fullPath);
exists = st.isFile();
} catch {
exists = false;
}
Expand Down
6 changes: 5 additions & 1 deletion packages/core/src/utils/fileUtils.ts
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import { ToolErrorType } from '../tools/tool-error.js';
import { BINARY_EXTENSIONS } from './ignorePatterns.js';
import { createRequire as createModuleRequire } from 'node:module';
import { debugLogger } from './debugLogger.js';
import { resolveToRealPath } from './paths.js';
import {
DEFAULT_MAX_LINES_TEXT_FILE,
MAX_LINE_LENGTH_TEXT_FILE,
Expand Down Expand Up @@ -350,7 +351,10 @@ export async function isEmpty(filePath: string): Promise<boolean> {
*/
export async function isBinaryFile(filePath: string): Promise<boolean> {
try {
return await isBinaryFileCheck(filePath);
const realPath = resolveToRealPath(filePath);
const stats = await fsPromises.stat(realPath);
if (stats.isDirectory()) return false;

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would this be better as !isFile() instead?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right. isDirectory() will return false for sockets, FIFOs, and block devices, which would cause a potential hang. !isFile() would be the right choice for this matter , Thank you for the suggestion . As for resolveToRealPath, I'll remove, it was unnecessary overhead since we're only doing a check here, not exposing or writing the path anywhere.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lemme fix those two parts

return await isBinaryFileCheck(realPath);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

While resolveToRealPath is synchronous, its use is required for consistent path resolution and internal validation to prevent path traversal vulnerabilities (Rule 3, Rule 9). To improve performance and avoid redundant I/O, use fs.promises.stat asynchronously to check for directories and pass the resulting size to the binary check (Rule 4). Additionally, ensure all built-in Node.js modules use the node: prefix for imports (Rule 8).

Suggested change
const realPath = resolveToRealPath(filePath);
const stats = await fsPromises.stat(realPath);
if (stats.isDirectory()) return false;
return await isBinaryFileCheck(realPath);
const resolvedPath = resolveToRealPath(filePath);
const stats = await fs.promises.stat(resolvedPath);
if (stats.isDirectory()) return false;
return await isBinaryFileCheck(resolvedPath, stats.size);
References
  1. Ensure consistent path resolution by using a single, robust function (e.g., resolveToRealPath) for all related path validations.
  2. Utility functions that perform file system operations should validate their path inputs internally to prevent path traversal vulnerabilities.
  3. Use the node: prefix when importing built-in Node.js modules for consistency across the codebase.
  4. Use asynchronous file system operations instead of synchronous ones to avoid blocking the event loop.

} catch (error) {
debugLogger.warn(
`Failed to check if file is binary: ${filePath}`,
Expand Down
Loading