teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 4

fix: sanitize enrichment target_file path traversal
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source 
Path(target).name strips directory components from LLM-generated
target filenames, preventing path traversal via ../. Same pattern
already applied to claim filenames (line 404) and entity filenames
(line 416). Ganymede-approved.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
m3taversal 2026-04-16 13:40:37 +01:00
parent 46ad508de7
commit 4c3ce265e4
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/extract.py
View file

@ -483,7 +483,7 @@ async def _extract_one_source(
if not target or not evidence:
continue
# Find the target claim file in the worktree (search domains/)
target_stem = target.replace(".md", "")
target_stem = Path(target.replace(".md", "")).name
found = None
for domain_dir in (worktree / "domains").iterdir():
candidate = domain_dir / f"{target_stem}.md"