From bc3df6114de7a6d90a43cbc29f377c740c7e5b7d Mon Sep 17 00:00:00 2001 From: anupamme Date: Fri, 11 Sep 2026 01:45:25 +0000 Subject: [PATCH] fix: add path validation in cleanup-path.ts The CleanupPathCommand accepts user-provided paths via CLI arguments and passes them directly to the deleteAsync function from the 'del' library without validation or sanitization --- src/cli/command/cleanup-path.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/cli/command/cleanup-path.ts b/src/cli/command/cleanup-path.ts index 08f58d1292..82ac9d6922 100644 --- a/src/cli/command/cleanup-path.ts +++ b/src/cli/command/cleanup-path.ts @@ -24,6 +24,14 @@ export class CleanupPathCommand extends Command { const start = Date.now(); let error = false; const paths = this.cleanupPaths.flatMap((p) => p.split(':')); + + // reject path traversal sequences to avoid deleting files outside of the requested paths + const invalid = paths.filter((p) => /(^|[/\\])\.\.([/\\]|$)/.test(p)); + if (invalid.length) { + logger.error({ paths: invalid }, 'Invalid cleanup path(s) detected'); + return 1; + } + logger.info({ paths }, `Cleanup paths ...`); try { const deleted = await deleteAsync(paths, { dot: true });