fix: arbitrary file write outside repo scope vulnerability

app/server/appsmith-git/src/main/java/com/appsmith/git/files/FileUtilsCEImpl.java

@@ -659,6 +659,27 @@ protected Set<String> updateEntitiesInRepo(ApplicationGitReference applicationGi
         return validPages;
     }
 
+    /**
+     * Validates that the given target path, after normalization, is still contained within
+     * the configured Git root directory. This is a defense-in-depth measure to prevent
+     * path traversal attacks where crafted resource names could cause file writes outside
+     * the repository.
+     *
+     * @param targetPath the resolved path intended for a file write
+     * @throws AppsmithPluginException if the path escapes the Git root directory
+     */
+    private void validatePathIsWithinGitRoot(Path targetPath) {
+        Path normalizedTarget = targetPath.toAbsolutePath().normalize();
+        Path gitRoot =
+                Paths.get(gitServiceConfig.getGitRootPath()).toAbsolutePath().normalize();
+        if (!normalizedTarget.startsWith(gitRoot)) {
+            String errorMessage = "SECURITY: Path traversal detected. Attempted to write to " + normalizedTarget
+                    + " which is outside the Git root " + gitRoot;
+            log.error(errorMessage);
+            throw new AppsmithPluginException(AppsmithPluginError.PLUGIN_ERROR, errorMessage);
+        }
+    }
+
     /**
      * This method will be used to store the DB resource to JSON file
      *
@@ -667,6 +688,7 @@ protected Set<String> updateEntitiesInRepo(ApplicationGitReference applicationGi
      * @return if the file operation is successful
      */
     protected boolean saveResource(Object sourceEntity, Path path) {
+        validatePathIsWithinGitRoot(path);
         try {
             Files.createDirectories(path.getParent());
             return fileOperations.writeToFile(sourceEntity, path);
@@ -678,6 +700,7 @@ protected boolean saveResource(Object sourceEntity, Path path) {
     }
 
     protected void saveResourceCommon(Object sourceEntity, Path path) {
+        validatePathIsWithinGitRoot(path);
         try {
             Files.createDirectories(path.getParent());
             if (sourceEntity instanceof String s) {
@@ -707,6 +730,7 @@ protected void saveResourceCommon(Object sourceEntity, Path path) {
      */
     private boolean saveActionCollection(Object sourceEntity, String body, String resourceName, Path path) {
         Span span = observationHelper.createSpan(GitSpan.FILE_WRITE);
+        validatePathIsWithinGitRoot(path);
         try {
             Files.createDirectories(path);
             if (StringUtils.hasText(body)) {
@@ -742,6 +766,7 @@ private boolean saveActionCollection(Object sourceEntity, String body, String re
      */
     private boolean saveActions(Object sourceEntity, String body, String resourceName, Path path) {
         Span span = observationHelper.createSpan(GitSpan.FILE_WRITE);
+        validatePathIsWithinGitRoot(path);
         try {
             Files.createDirectories(path);
             // Write the user written query to .txt file to make conflict handling easier

app/server/appsmith-server/src/main/java/com/appsmith/server/dtos/ce/ActionCollectionCE_DTO.java

@@ -101,6 +101,11 @@ public class ActionCollectionCE_DTO {
 
     public Set<String> validate() {
         Set<String> validationErrors = new HashSet<>();
+        if (this.name == null || this.name.trim().isEmpty()) {
+            validationErrors.add(AppsmithError.INVALID_PARAMETER.getMessage(FieldName.NAME));
+        } else if (containsUnsafePathCharacters(this.name)) {
+            validationErrors.add(AppsmithError.INVALID_PARAMETER.getMessage(FieldName.NAME));
+        }
         if (this.workspaceId == null) {
             validationErrors.add(AppsmithError.INVALID_PARAMETER.getMessage(FieldName.WORKSPACE_ID));
         }
@@ -113,6 +118,18 @@ public Set<String> validate() {
         return validationErrors;
     }
 
+    /**
+     * Checks if the given name contains characters that could be used for path traversal attacks.
+     * This prevents directory traversal via names like "../../../etc/passwd" when the name is
+     * used as part of file paths during Git serialization.
+     *
+     * @param name the name to check
+     * @return true if the name contains unsafe path characters
+     */
+    private static boolean containsUnsafePathCharacters(String name) {
+        return name.contains("..") || name.contains("/") || name.contains("\\") || name.indexOf('\0') >= 0;
+    }
+
     public void populateTransientFields(ActionCollection actionCollection) {
         this.setId(actionCollection.getId());
         this.setBaseId(actionCollection.getBaseIdOrFallback());

app/server/appsmith-server/src/main/java/com/appsmith/server/helpers/ce/CommonGitFileUtilsCE.java

@@ -292,6 +292,7 @@ protected void setArtifactIndependentResources(
         if (datasourceList != null) {
             datasourceList.forEach(datasource -> {
                 removeUnwantedFieldsFromDatasource(datasource);
+                validateGitSerializableName(datasource.getName(), "Datasource");
                 final String filePath = DATASOURCE_DIRECTORY + DELIMITER_PATH + datasource.getName() + JSON_EXTENSION;
                 GitResourceIdentity identity =
                         new GitResourceIdentity(GitResourceType.DATASOURCE_CONFIG, datasource.getGitSyncId(), filePath);
@@ -369,6 +370,7 @@ protected void setNewActionsInResourceMap(
                 .forEach(newAction -> {
                     ActionDTO action = newAction.getUnpublishedAction();
                     final String actionFileName = action.getUserExecutableName().replace(".", "-");
+                    validateGitSerializableName(actionFileName, "Action");
                     final String filePathPrefix = getContextDirectoryByType(action.getContextType())
                             + DELIMITER_PATH
                             + action.calculateContextId()
@@ -429,6 +431,7 @@ protected void setActionCollectionsInResourceMap(
                 .forEach(actionCollection -> {
                     ActionCollectionDTO collection = actionCollection.getUnpublishedCollection();
                     final String collectionName = collection.getUserExecutableName();
+                    validateGitSerializableName(collectionName, "ActionCollection");
                     final String filePathPrefix = getContextDirectoryByType(collection.getContextType())
                             + DELIMITER_PATH
                             + collection.calculateContextId()
@@ -782,6 +785,27 @@ public Mono<Boolean> checkIfDirectoryIsEmpty(Path baseRepoSuffix) throws IOExcep
                 .onErrorResume(e -> Mono.error(new AppsmithException(AppsmithError.GIT_FILE_SYSTEM_ERROR, e)));
     }
 
+    /**
+     * Validates that a resource name intended for use as a Git file path segment does not contain
+     * path traversal sequences or directory separator characters. This is a defense-in-depth measure
+     * that prevents arbitrary file writes even if input validation at the API layer is bypassed.
+     *
+     * @param resourceName the name to validate
+     * @param resourceType a human-readable description of the resource type (for error messages)
+     * @throws AppsmithException if the name contains path traversal or directory separator characters
+     */
+    protected static void validateGitSerializableName(String resourceName, String resourceType) {
+        if (resourceName != null
+                && (resourceName.contains("..")
+                        || resourceName.contains("/")
+                        || resourceName.contains("\\")
+                        || resourceName.indexOf('\0') >= 0)) {
+            log.error("SECURITY: Path traversal attempt detected in {} name: '{}'", resourceType, resourceName);
+            throw new AppsmithException(
+                    AppsmithError.GIT_FILE_SYSTEM_ERROR, "Path traversal detected in " + resourceType + " name");
+        }
+    }
+
     public static void removeUnwantedFieldsFromBaseDomain(BaseDomain baseDomain) {
         baseDomain.setPolicies(null);
         baseDomain.setUserPermissions(null);