From dd75f0b56e51f464eb4380e45d186a8d2083bec4 Mon Sep 17 00:00:00 2001 From: Goksu Ceylan Date: Thu, 19 Feb 2026 08:46:39 -0500 Subject: [PATCH] fix(security): Symlink TOCTOU race condition --- pkg/tools/filesystem.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/tools/filesystem.go b/pkg/tools/filesystem.go index 09063ea0a6..41bf4298ba 100644 --- a/pkg/tools/filesystem.go +++ b/pkg/tools/filesystem.go @@ -43,6 +43,9 @@ func validatePath(path, workspace string, restrict bool) (string, error) { if !isWithinWorkspace(resolved, workspaceReal) { return "", fmt.Errorf("access denied: symlink resolves outside workspace") } + // Return the resolved path to prevent TOCTOU race + // the caller operates on the validated target directly. + absPath = resolved } else if os.IsNotExist(err) { if parentResolved, err := resolveExistingAncestor(filepath.Dir(absPath)); err == nil { if !isWithinWorkspace(parentResolved, workspaceReal) {