AI-2134 Validate issue_id and --root in init_task_record.py to block path traversal#3
Open
Harukaon wants to merge 1 commit into
Conversation
… traversal scripts/init_task_record.py previously accepted any string for the issue_id positional argument and --root flag, then composed it into a filesystem path with Path(...). This let: * '../etc/passwd' -> escape the tasks/ root * '/etc/passwd' -> write to an absolute path * '' -> create a stray 'tasks/' dir * whitespace / newlines -> split arguments if piped to a shell The validator now requires a strict Linear identifier format (<TEAM_KEY>-<NUMBER>, e.g. AI-2134), rejects whitespace, path separators, and shell metacharacters, refuses absolute --root, and verifies that the resolved task dir is still under the artifact root before creating it. Also adds tests/test_init_task_record.py (18 cases: unit-level + argv-level smoke) and updates CHANGELOG.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
scripts/init_task_record.pypreviously accepted any string for theissue_idpositional argument and--rootflag, then composed it directly into a filesystem path withPath(...). That let:../etc/passwd→ escape thetasks/root/etc/passwd→ write to an absolute path""→ create a straytasks/directoryThis PR tightens the validator:
issue_idto match a strict Linear identifier format (<TEAM_KEY>-<NUMBER>, e.g.AI-2134)./\;&|\$><\n\r\t`) up front so the error message is clear.--rootto be a relative path with no..segments.2on invalid input (was: stack trace, exit code 1).Tests
tests/test_init_task_record.py— 18 unit + argv-level cases covering the happy path, lowercase normalization, path traversal, absolute paths, whitespace, missing dash, missing number, hidden.., and an end-to-end subprocess invocation that confirms bad input is rejected at the CLI layer.Related
sync_comment.py+install.sh), so no conflict.Checklist
init_task_record.py, newtests/,CHANGELOG.md)