vrr/agent-zero
2
0
Fork 0
mirror of https://github.com/agent0ai/agent-zero.git synced 2026-05-22 19:47:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix: prevent path traversal in save_text_file

Browse source
This commit is contained in:
Lê Quốc Vương 2026-04-24 08:53:45 +07:00
parent 3fa8481ba2
commit 813dfaf375
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
helpers/file_browser.py
View file

@ -169,7 +169,7 @@ class FileBrowser:
raise ValueError("File exceeds 1 MB and cannot be edited")
full_path = (self.base_dir / file_path).resolve()
if not str(full_path).startswith(str(self.base_dir)):
if not full_path.is_relative_to(self.base_dir.resolve()):
raise ValueError("Invalid path")
if full_path.exists() and full_path.is_dir():
raise ValueError("Target is a directory")