🛡️ Sentinel: [CRITICAL] Fix Path Traversal in API Files Get Endpoint

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-06-28 - [Path Traversal in API Files Get Endpoint]
+**Vulnerability:** Path traversal vulnerability in API endpoint `api/api_files_get.py`. The `paths` array allowed retrieving files outside of the intended directories when path traversal elements (e.g. `../../../`) are provided in the path or filename.
+**Learning:** `files.get_abs_path()` and `os.path.basename()` alone do not resolve paths safely against path traversal if malicious components bypass `basename()` or traverse out after `get_abs_path` resolves. A strict boundary check must be explicitly made.
+**Prevention:** Always validate that the final resolved absolute path is within the intended base directory using `files.is_in_base_dir(external_path)`.

api/api_files_get.py

@@ -62,6 +62,11 @@ async def process(self, input: dict, request: Request) -> dict | Response:
                         external_path = path
                         filename = os.path.basename(path)
 
+                    # Security check: Ensure the path is within the base directory
+                    if not files.is_in_base_dir(external_path):
+                        PrintStyle.warning(f"Access denied. Path is outside of base directory: {path}")
+                        continue
+
                     # Check if file exists
                     if not os.path.exists(external_path):
                         PrintStyle.warning(f"File not found: {path}")