From 5de6e38e12e96718960e6f11ab7917e220f5d399 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Tue, 9 Jun 2026 18:07:57 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL/H?= =?UTF-8?q?IGH]=20Fix=20path=20traversal=20normalization=20bug?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes a path normalization issue where popping components naively allowed relative traversals (`../`) to be silently ignored when reaching the root or when stacking multiple traversals, potentially bypassing bounds checks. Co-authored-by: bashandbone <89049923+bashandbone@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ crates/ast-engine/src/tree_sitter/mod.rs | 10 ++++++---- .../src/incremental/extractors/typescript.rs | 13 +++++++++--- crates/flow/tests/d1_cache_integration.rs | 4 ---- crates/rule-engine/src/check_var.rs | 20 +++++++++---------- crates/rule-engine/src/rule/mod.rs | 6 +++++- crates/rule-engine/src/rule/referent_rule.rs | 5 +---- 7 files changed, 36 insertions(+), 26 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 00000000..169b1faf --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2025-02-14 - Fix Path Traversal Normalization Bug in File System Resolution +**Vulnerability:** In `crates/flow/src/incremental/extractors/typescript.rs` and potentially elsewhere, path normalization logic used `components.pop()` when encountering `Component::ParentDir`. When `components` was empty or ended with another `Component::ParentDir`, this ignored `../` components rather than accumulating them, leading to incorrect path resolution or potential path traversal issues outside expected bounds. +**Learning:** `Vec::pop()` silently returns `None` on an empty vector. Using it without checking the preceding components in a path navigation allows relative paths like `../../` to be collapsed incorrectly. +**Prevention:** Explicitly check the last component. If it's empty or also a `ParentDir`, append the `ParentDir` to accurately represent `../` navigation, or return an error if such paths are not allowed in the context. diff --git a/crates/ast-engine/src/tree_sitter/mod.rs b/crates/ast-engine/src/tree_sitter/mod.rs index 3762df92..7bd59d1d 100644 --- a/crates/ast-engine/src/tree_sitter/mod.rs +++ b/crates/ast-engine/src/tree_sitter/mod.rs @@ -553,9 +553,8 @@ impl ContentExt for String { let mut bytes = std::mem::take(self).into_bytes(); let original_len = bytes.len(); bytes.splice(safe_start..safe_end, full_inserted); - *self = Self::from_utf8(bytes).unwrap_or_else(|e| { - Self::from_utf8_lossy(&e.into_bytes()).into_owned() - }); + *self = Self::from_utf8(bytes) + .unwrap_or_else(|e| Self::from_utf8_lossy(&e.into_bytes()).into_owned()); // We calculate new_end_byte using the difference in the new overall string length // to correctly align the end offset, taking any potential replacement bytes from @@ -791,7 +790,10 @@ mod test { let tree2 = parse_lang(|p| p.parse(&src, Some(&tree)), &Tsx.get_ts_language())?; let fresh_tree = parse(&src)?; - assert_eq!(tree2.root_node().to_sexp(), fresh_tree.root_node().to_sexp()); + assert_eq!( + tree2.root_node().to_sexp(), + fresh_tree.root_node().to_sexp() + ); Ok(()) } } diff --git a/crates/flow/src/incremental/extractors/typescript.rs b/crates/flow/src/incremental/extractors/typescript.rs index 1bdda4ef..4efe8e27 100644 --- a/crates/flow/src/incremental/extractors/typescript.rs +++ b/crates/flow/src/incremental/extractors/typescript.rs @@ -807,9 +807,16 @@ impl TypeScriptDependencyExtractor { let mut components = Vec::new(); for component in resolved.components() { match component { - std::path::Component::ParentDir => { - components.pop(); - } + std::path::Component::ParentDir => match components.last() { + Some(std::path::Component::RootDir) + | Some(std::path::Component::Prefix(_)) => {} + Some(std::path::Component::ParentDir) | None => { + components.push(component); + } + _ => { + components.pop(); + } + }, std::path::Component::CurDir => {} _ => components.push(component), } diff --git a/crates/flow/tests/d1_cache_integration.rs b/crates/flow/tests/d1_cache_integration.rs index 2262e29e..4d88829a 100644 --- a/crates/flow/tests/d1_cache_integration.rs +++ b/crates/flow/tests/d1_cache_integration.rs @@ -168,9 +168,5 @@ mod d1_no_cache_tests { .expect("Failed to create context without caching"); // Should compile and work without cache field - assert!( - true, - "D1ExportContext created successfully without caching feature" - ); } } diff --git a/crates/rule-engine/src/check_var.rs b/crates/rule-engine/src/check_var.rs index 9e401055..d031a6f9 100644 --- a/crates/rule-engine/src/check_var.rs +++ b/crates/rule-engine/src/check_var.rs @@ -27,8 +27,8 @@ pub enum CheckHint<'r> { pub fn check_rule_with_hint<'r>( rule: &'r Rule, utils: &'r RuleRegistration, - constraints: &'r RapidMap, - transform: &'r Option, + constraints: &RapidMap, + transform: &Option, fixer: &Vec, hint: CheckHint<'r>, ) -> RResult<()> { @@ -56,8 +56,8 @@ pub fn check_rule_with_hint<'r>( fn check_vars_in_rewriter<'r>( rule: &'r Rule, utils: &'r RuleRegistration, - constraints: &'r RapidMap, - transform: &'r Option, + constraints: &RapidMap, + transform: &Option, fixer: &Vec, upper_var: &RapidSet, ) -> RResult<()> { @@ -85,8 +85,8 @@ fn check_utils_defined( fn check_vars<'r>( rule: &'r Rule, utils: &'r RuleRegistration, - constraints: &'r RapidMap, - transform: &'r Option, + constraints: &RapidMap, + transform: &Option, fixer: &Vec, ) -> RResult<()> { let vars = get_vars_from_rules(rule, utils); @@ -104,9 +104,9 @@ fn get_vars_from_rules<'r>(rule: &'r Rule, utils: &'r RuleRegistration) -> Rapid vars } -fn check_var_in_constraints<'r>( +fn check_var_in_constraints( mut vars: RapidSet, - constraints: &'r RapidMap, + constraints: &RapidMap, ) -> RResult> { for rule in constraints.values() { for var in rule.defined_vars() { @@ -125,9 +125,9 @@ fn check_var_in_constraints<'r>( Ok(vars) } -fn check_var_in_transform<'r>( +fn check_var_in_transform( mut vars: RapidSet, - transform: &'r Option, + transform: &Option, ) -> RResult> { let Some(transform) = transform else { return Ok(vars); diff --git a/crates/rule-engine/src/rule/mod.rs b/crates/rule-engine/src/rule/mod.rs index d1d77120..a2433f3e 100644 --- a/crates/rule-engine/src/rule/mod.rs +++ b/crates/rule-engine/src/rule/mod.rs @@ -246,7 +246,11 @@ impl Rule { pub fn defined_vars(&self) -> RapidSet { match self { - Rule::Pattern(p) => p.defined_vars().into_iter().map(|s| s.to_string()).collect(), + Rule::Pattern(p) => p + .defined_vars() + .into_iter() + .map(|s| s.to_string()) + .collect(), Rule::Kind(_) => RapidSet::default(), Rule::Regex(_) => RapidSet::default(), Rule::NthChild(n) => n.defined_vars(), diff --git a/crates/rule-engine/src/rule/referent_rule.rs b/crates/rule-engine/src/rule/referent_rule.rs index dd947bc7..74d480e0 100644 --- a/crates/rule-engine/src/rule/referent_rule.rs +++ b/crates/rule-engine/src/rule/referent_rule.rs @@ -27,10 +27,7 @@ impl Clone for Registration { impl Registration { fn read(&self) -> Arc> { - self.0 - .read() - .unwrap_or_else(|e| e.into_inner()) - .clone() + self.0.read().unwrap_or_else(|e| e.into_inner()).clone() } pub(crate) fn contains_key(&self, key: &str) -> bool { self.read().contains_key(key)