Python Incorrect directory boundary check using strings.HasPrefix #1030
Description
Describe the bug
Bug 2: Incorrect directory boundary check using strings.HasPrefix
Description
The code attempts to prevent path traversal with:
strings.HasPrefix(filepath.Clean(fullPath), wd)This is unsafe because paths like /repo2/... also match the prefix /repo.
Impact
- Potential directory traversal.
- False positives and false negatives during path validation.
Suggested Fix
Use filepath.Rel() and reject paths starting with .., or ensure the prefix check includes a path separator boundary.
Current behavior
The code attempts to prevent directory traversal by checking whether the cleaned path string starts with the working directory string. This check can incorrectly succeed for paths outside the working directory that merely share the same string prefix.
Reproduction steps
Run as Is
Expected behavior
Path traversal protection should be correct and filesystem-aware:
Accept only paths that resolve inside the workspace.
Reject paths outside the workspace, including prefix-trick cases (e.g., /repo2 when workspace is /repo).
This should be implemented using robust path comparison (e.g., filepath.Rel, realpath checks, and separator-aware boundaries).
JFrog Frogbot version
LATEST
Package manager info
Python
Git provider
GitHub
JFrog Frogbot configuration yaml file
Default
Operating system type and version
ALL
JFrog Xray version
LATEST