DIS-005: Path-Traversal-Check in /new-agent #6

New issue

Closed

opened 2026-04-08 14:14:38 +00:00 by dev · 0 comments

dev commented

2026-04-08 14:14:38 +00:00

Owner

Ziel

/new-agent name:<x> akzeptiert keinen Namen, der aus dem Workspace-Root ausbricht. Defense in depth: Regex + path.resolve-Containment-Check.

Kontext

Edge-Cases: .., Unicode-Homoglyphen, ., leere Strings, Windows-reserved Names.
Referenz: docs/development-plan.md Phase 0 Task 4

Scope

In: Nach Regex in new-agent.ts: Containment-Check via path.resolve. Saubere User-Fehlermeldung in Discord.

Definition of Done

Containment-Check aktiv in src/commands/new-agent.ts
Unit-Test tests/unit/path-traversal.test.ts deckt ../etc, .., ./foo, a/../b, leerer String, CON, Unicode
npm run build && npm test gruen

Branch

phase-0/path-traversal-check

Abhaengigkeiten

Keine.

## Ziel `/new-agent name:<x>` akzeptiert keinen Namen, der aus dem Workspace-Root ausbricht. Defense in depth: Regex + `path.resolve`-Containment-Check. ## Kontext Edge-Cases: `..`, Unicode-Homoglyphen, `.`, leere Strings, Windows-reserved Names. Referenz: `docs/development-plan.md` Phase 0 Task 4 ## Scope **In:** Nach Regex in `new-agent.ts`: Containment-Check via `path.resolve`. Saubere User-Fehlermeldung in Discord. ## Definition of Done - [ ] Containment-Check aktiv in `src/commands/new-agent.ts` - [ ] Unit-Test `tests/unit/path-traversal.test.ts` deckt `../etc`, `..`, `./foo`, `a/../b`, leerer String, `CON`, Unicode - [ ] `npm run build && npm test` gruen ## Branch `phase-0/path-traversal-check` ## Abhaengigkeiten Keine.