actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-22 03:18:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

Harden delete_files MCP tool: validate paths within repo root (#1636)

Browse Source 
Mirror the path validation already performed by the commit_files tool.
delete_files previously only normalized absolute paths against CWD and
passed relative paths through unchecked; it now runs each path through
validatePathWithinRepo, rejecting "../" traversal and symlinked escapes
for consistency and defense-in-depth.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
gabrielonrails
2026-08-14 16:31:15 -07:00
committed by GitHub
co-authored by Claude Opus 4.8
parent 9d7150bc8a
commit 05ee4b30d7
1 changed files with 12 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mcp/github-file-ops-server.ts
+11 -14
View File
@@ -432,21 +432,18 @@ server.tool(
throw new Error("GITHUB_TOKEN environment variable is required"); throw new Error("GITHUB_TOKEN environment variable is required");
} }
// Convert absolute paths to relative if they match CWD // Validate all paths are within the repository root and normalize them to
const cwd = process.cwd(); // repo-relative paths for the git tree entries. This mirrors the validation
const processedPaths = paths.map((filePath) => { // already performed by the commit_files tool and rejects path traversal
if (filePath.startsWith("/")) { // ("../") and symlinked escapes as defense-in-depth.
if (filePath.startsWith(cwd)) { const resolvedRepoDir = resolve(REPO_DIR);
// Strip CWD from absolute path const processedPaths = await Promise.all(
return filePath.slice(cwd.length + 1); paths.map(async (filePath) => {
} else { await validatePathWithinRepo(filePath, REPO_DIR);
throw new Error( const normalizedPath = resolve(resolvedRepoDir, filePath);
`Path '${filePath}' must be relative to repository root or within current working directory`, return normalizedPath.slice(resolvedRepoDir.length + 1);
}),
); );
}
}
return filePath;
});
// 1. Get the branch reference (create if doesn't exist) // 1. Get the branch reference (create if doesn't exist)
const baseSha = await getOrCreateBranchRef( const baseSha = await getOrCreateBranchRef(