Python Symlink escape is not prevented

Describe the bug

Bug 3: Symlink escape is not prevented

Description

Even if the path string passes validation, the code does not protect against symlinks that point outside the working directory.

Impact

• A symlinked requirements file could allow reading or overwriting files outside the repository.
• Potential security risk in CI environments.

Suggested Fix

Resolve and validate real paths using filepath.EvalSymlinks() before reading or writing.

---

Current behavior

If the target file path is a symlink, the code follows it without verifying where it resolves to. Even if the symlink points outside the repository, the file is still read or written.

Reproduction steps

Run As Is

Expected behavior

If the requirements/descriptor file is a symlink, Frogbot should:

Resolve the symlink target (realpath) and

Ensure the resolved target is still within the workspace.
If it points outside, the operation should be rejected with a clear error.

JFrog Frogbot version

LATEST

Package manager info

Python

Git provider

GitHub

JFrog Frogbot configuration yaml file

Default

Operating system type and version

ALL

JFrog Xray version

LATEST

Start by locating the code that reads or writes the requirements/descriptor file and the path-validation entry point. Use filepath.EvalSymlinks() as the stated direction, then verify that resolved targets remain within the workspace and that outside targets produce a clear rejection.