Skip to content

Guard coding tools against workspace escapes#104

Open
gyx09212214-prog wants to merge 1 commit into
AI4Finance-Foundation:masterfrom
gyx09212214-prog:guard-coding-workspace-paths
Open

Guard coding tools against workspace escapes#104
gyx09212214-prog wants to merge 1 commit into
AI4Finance-Foundation:masterfrom
gyx09212214-prog:guard-coding-workspace-paths

Conversation

@gyx09212214-prog

Copy link
Copy Markdown

Summary

  • resolve CodingUtils paths against the configured coding workspace before file operations
  • reject paths that escape the workspace boundary before listing, reading, modifying, or creating files
  • add regression tests for normal file creation plus traversal attempts through create and modify tools

Closes #101.
Closes #102.

Validation

  • python -m pytest tests\test_coding_utils.py -q
  • python -m py_compile finrobot\functional\coding.py tests\test_coding_utils.py
  • git diff --check

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1.0.0 contains code injection in CodingUtils.create_file_with_code (). code injection in CodingUtils.modify_code () contained in FinRobot 1.0.0

1 participant