fix(jupyter): reject path-traversal segments in Jupyter content paths

encodeJupyterPath now rejects '.'/'..' segments across the whole path
(shared by all 16 tools, not just upload); the upload route returns a
clean 400 when it's hit.

Author: waleedlatif1

apps/sim/app/api/tools/jupyter/upload/route.ts

@@ -18,6 +18,7 @@ import {
   buildJupyterAuthHeaders,
   encodeJupyterPath,
   normalizeJupyterServerUrl,
+  UnsafeJupyterPathError,
 } from '@/tools/jupyter/utils'
 
 export const dynamic = 'force-dynamic'
@@ -76,7 +77,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     const base = normalizeJupyterServerUrl(data.serverUrl)
     const destinationDirectory = (data.directory ?? '').replace(/\/+$/, '')
     const destinationPath = destinationDirectory ? `${destinationDirectory}/${fileName}` : fileName
-    const uploadUrl = `${base}/api/contents/${encodeJupyterPath(destinationPath)}`
+
+    let encodedDestinationPath: string
+    try {
+      encodedDestinationPath = encodeJupyterPath(destinationPath)
+    } catch (error) {
+      if (error instanceof UnsafeJupyterPathError) {
+        return NextResponse.json({ success: false, error: error.message }, { status: 400 })
+      }
+      throw error
+    }
+    const uploadUrl = `${base}/api/contents/${encodedDestinationPath}`
 
     const urlValidation = await validateUrlWithDNS(uploadUrl, 'serverUrl', { allowHttp: true })
     if (!urlValidation.isValid || !urlValidation.resolvedIP) {

apps/sim/tools/jupyter/utils.ts

@@ -47,16 +47,34 @@ export function buildJupyterAuthHeaders(token: string): Record<string, string> {
   return { Authorization: `token ${token}` }
 }
 
+/**
+ * Error thrown when a user-supplied Jupyter contents path contains a `.` or
+ * `..` segment that could traverse outside the intended directory.
+ */
+export class UnsafeJupyterPathError extends Error {
+  constructor(rawPath: string) {
+    super(`Invalid Jupyter path: ${rawPath}`)
+    this.name = 'UnsafeJupyterPathError'
+  }
+}
+
 /**
  * Encodes a Jupyter contents path segment-by-segment so slashes stay as path
  * separators while special characters within a segment are escaped.
+ *
+ * @throws {UnsafeJupyterPathError} when a segment is `.` or `..`, which could
+ * otherwise traverse outside the intended directory on the target server.
  */
 export function encodeJupyterPath(path: string | undefined): string {
-  return (path ?? '')
-    .split('/')
-    .filter((segment) => segment.length > 0)
-    .map(encodeURIComponent)
-    .join('/')
+  const segments = (path ?? '').split('/').filter((segment) => segment.length > 0)
+
+  for (const segment of segments) {
+    if (segment === '.' || segment === '..') {
+      throw new UnsafeJupyterPathError(path ?? '')
+    }
+  }
+
+  return segments.map(encodeURIComponent).join('/')
 }
 
 interface RawJupyterKernel {