From a1795676cd5bca819ea10cc2e2239c5e0d66d85e Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Thu, 28 May 2026 17:36:48 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?= =?UTF-8?q?x=20path=20traversal=20in=20manual=20path=20normalization?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Updated `resolve_module_path` manual path normalization to safely handle `Component::ParentDir`. - Prevents popping `RootDir` or `Prefix` components during manual canonicalization of non-existent paths. Co-authored-by: bashandbone <89049923+bashandbone@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ crates/flow/src/incremental/extractors/typescript.rs | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 00000000..4fbafbe4 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-05-18 - [Path Traversal in Manual Path Resolution] +**Vulnerability:** In `resolve_module_path`, manual path normalization for unresolved paths incorrectly popped `std::path::Component::ParentDir` from the components list regardless of the previous component. This could pop `RootDir` or `Prefix` components, leading to potential path traversal vulnerabilities or generating entirely wrong absolute paths when given multiple `..` segments. +**Learning:** `std::path::Component` does not inherently block you from popping structural elements like `RootDir`. When manually normalizing paths by collecting components, you must handle `..` explicitly by checking the last element before popping. +**Prevention:** Always verify the type of the last component before popping it for a `ParentDir`. Explicitly ignore `ParentDir` if the last component is `RootDir` or `Prefix`, and push it if the list is empty or the last component is also `ParentDir`. diff --git a/crates/flow/src/incremental/extractors/typescript.rs b/crates/flow/src/incremental/extractors/typescript.rs index 1bdda4ef..9741c310 100644 --- a/crates/flow/src/incremental/extractors/typescript.rs +++ b/crates/flow/src/incremental/extractors/typescript.rs @@ -808,7 +808,15 @@ impl TypeScriptDependencyExtractor { for component in resolved.components() { match component { std::path::Component::ParentDir => { - components.pop(); + if let Some(last) = components.last() { + match last { + std::path::Component::RootDir | std::path::Component::Prefix(_) => {} + std::path::Component::ParentDir => components.push(component), + _ => { components.pop(); } + } + } else { + components.push(component); + } } std::path::Component::CurDir => {} _ => components.push(component),