Ayuriel/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce archive path containment when sessions dir is missing

Browse Source 
Use path.resolve(sessionsDir) as fallback when realpathSync fails,
ensuring the traversal guard stays active even for nonexistent agent
directories. Previously the guard was skipped entirely.
This commit is contained in:
robo7 2026-03-14 00:11:52 +08:00
parent 038186e30d
commit 5dda42a49f
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/gateway/server-methods/usage.ts
View File

@ -90,13 +90,12 @@ function resolveSessionUsageFileOrRespond(
try {
realSessionsDir = fs.realpathSync(sessionsDir);
} catch {
// Sessions directory doesn't exist for this agent — no archived file possible
// Fall through to normal resolution
realSessionsDir = "";
// Sessions directory doesn't exist — use path.resolve as fallback base
// to still enforce containment against traversal attacks
realSessionsDir = path.resolve(sessionsDir);
}
const realSessionFile = path.resolve(sessionFile);
if (
realSessionsDir &&
!realSessionFile.startsWith(realSessionsDir + path.sep) &&
realSessionFile !== realSessionsDir
) {