dev/disclaw
1
0
Fork 0
Code Issues 9 Pull requests 1 Projects Releases Packages Wiki Activity Actions
disclaw/tasks/DIS-005.md
Nick Tabeling 722d85c2a5
Some checks failed
CI / build-and-test (ubuntu-latest) (pull_request) Has been cancelled
Details
CI / build-and-test (windows-latest) (pull_request) Has been cancelled
Details
CI / lint (pull_request) Has been cancelled
Details
chore: update task board — Phase 0 and Phase 1 marked done 
All DIS-001 through DIS-110 set to status:done with merge dates.
BOARD.md reorganized with Done sections per phase.
Phase 1.5 Refinement epic added as planning placeholder.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-10 10:42:16 +02:00

1.5 KiB
Raw Blame History

id status phase priority labels branch assignee started pr merged
DIS-005 done 0 p0
phase:0
type:fix
priority:p0
security
phase-0/path-traversal-check claude-agent null null 2026-04-08

DIS-005: Path-Traversal-Check in /new-agent

Ziel

/new-agent name:<x> akzeptiert keinen Namen, der aus dem Workspace-Root ausbricht. Defense in depth: Regex-Validierung + expliziter path.resolve-Containment-Check.

Kontext

Aktuell gibt es Regex-Validierung in src/commands/new-agent.ts, aber keinen path.resolve-Containment-Check. Edge-Cases: .., Unicode-Homoglyphen, ., leere Strings, Windows-reserved Names. → docs/development-plan.md Phase 0 Task 4.

Scope

  • In: Nach Regex in new-agent.ts: 
    const root = path.resolve(config.workspaces_root);
const wsPath = path.resolve(root, name);
if (!wsPath.startsWith(root + path.sep)) throw new Error("Path traversal");
    Saubere User-Fehlermeldung im Discord-Channel.
  • Out: Unicode-Normalisierung über Regex hinaus

Definition of Done

  • Containment-Check ist aktiv in src/commands/new-agent.ts
  • Unit-Test tests/unit/path-traversal.test.ts deckt: ../etc, .., ./foo, a/../b, leerer String, CON (Windows-reserved), Unicode-Homoglyphen
  • npm run build && npm test grün

Dateien (erwartet)

  • src/commands/new-agent.ts
  • tests/unit/path-traversal.test.ts

Abhängigkeiten

Keine. Kann parallel laufen.

Spec

→ docs/backlog.md #DIS-005