Python Incorrect directory boundary check using strings.HasPrefix

Describe the bug

Bug 2: Incorrect directory boundary check using strings.HasPrefix

Description

The code attempts to prevent path traversal with:

strings.HasPrefix(filepath.Clean(fullPath), wd)

This is unsafe because paths like /repo2/... also match the prefix /repo.

Impact

• Potential directory traversal.
• False positives and false negatives during path validation.

Suggested Fix

Use filepath.Rel() and reject paths starting with .., or ensure the prefix check includes a path separator boundary.

Current behavior

The code attempts to prevent directory traversal by checking whether the cleaned path string starts with the working directory string. This check can incorrectly succeed for paths outside the working directory that merely share the same string prefix.

Reproduction steps

Run as Is

Expected behavior

Path traversal protection should be correct and filesystem-aware:

Accept only paths that resolve inside the workspace.

Reject paths outside the workspace, including prefix-trick cases (e.g., /repo2 when workspace is /repo).
This should be implemented using robust path comparison (e.g., filepath.Rel, realpath checks, and separator-aware boundaries).

JFrog Frogbot version

LATEST

Package manager info

Python

Git provider

GitHub

JFrog Frogbot configuration yaml file

Default

Operating system type and version

ALL

JFrog Xray version

LATEST

Search the Go codebase for strings.HasPrefix(filepath.Clean(fullPath), wd) and inspect the surrounding path-validation flow and any existing tests. Add regression coverage for a workspace such as /repo and an outside path such as /repo2, then run the relevant Go tests. Done means paths resolve inside the workspace while prefix-trick paths are rejected.