[bug] 路径穿越（绝对路径绕过 workspace 边界）

Open

#89 opened on Jul 3, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 72/100

Issue type: Bug
Clarity: Clearly specified
Activity status: Quiet
Tech stack: typescript
Domain: cli, security

Research direction

Start by locating resolveWorkspacePath and the shell-tools glob/grep operations, then compare their path handling with the existing cross-platform boundary check in file-tools. Verify that absolute paths outside workspaceRoot are rejected or confined to the workspace, while valid workspace paths still work.

Written by the indexing model from the issue text.

Description

status/needs-triage type/bug

step-realtime-cli 版本

1.0.0

Node 版本 & OS

Node 24.16.0 / Linux (Fedora 44)

复现步骤

在 step CLI 中对助手说"读取 /etc/passwd"
模型调用 glob/grep 工具时传入绝对路径参数
resolveWorkspacePath 直接返回 /etc/passwd
文件内容被读取并返回给模型

期望行为

绝对路径应验证前缀为 workspaceRoot，否则拒绝或 resolve 到 workspace root。file-tools 已有类似的跨平台边界检查，shell-tools 的 glob/grep 操作缺了这层

实际行为

绝对路径被直接使用，可读取 workspace 外任意文件

日志 / 堆栈

截图（可选）

No response

自检

我已搜索 existing issues，确认这不是重复问题
我已阅读 CONTRIBUTING.md

Dominant language: TypeScript
Stars: 54
Forks: 20
Avg merge: 2h 58m
Merged PRs (30d): 1

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Cloudflare scaffold recommends the keyless cloudflare/... model but never declares the AI binding it requires Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

withastro/flue#739 · Opened Sep 21, 2026
Do not render a phantom EOF line in read output Open

area:tools bug good first issue help wanted priority:P2

Difficulty 2/5 1-3 hours Newbie friendliness 90/100

TaewoooPark/Motifcode#14 · Opened Sep 21, 2026
Antigravity CLI: PostToolUse hook misidentified as PreToolUse due to `toolCall` check, causing protojson error Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

newrelic-experimental/preflight#793 · 1 comment · Opened Sep 21, 2026
[Bug]: Motrix 2.0.0-beta 40: 下载列表的头分隔条无法向左调 Open

bug 🐞

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

agalwood/Motrix#2182 · 1 comment · Opened Sep 21, 2026
[Bounty proposal] fix(web): memory insights count an evening memory on the next day ($25 proposed) Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

BasedHardware/omi#15320 · Opened Sep 21, 2026

More TypeScript issues