shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(coding-agent): harden git package install paths

Browse Source
This commit is contained in:
Armin Ronacher
2026-06-02 18:20:35 +02:00
parent 0462d44f56
commit a98e087e5d
5 changed files with 109 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
packages/coding-agent/src/core/package-manager.ts
View File

@@ -1952,10 +1952,11 @@ export class DefaultPackageManager implements PackageManager {
if (scope === "temporary") {
return this.getTemporaryDir(`git-${source.host}`, source.path);
}
if (scope === "project") {
return join(this.cwd, CONFIG_DIR_NAME, "git", source.host, source.path);
const installRoot = this.getGitInstallRoot(scope);
if (!installRoot) {
throw new Error("Missing git install root");
}
return join(this.agentDir, "git", source.host, source.path);
return this.resolveManagedPath(installRoot, source.host, source.path);
}
private getGitInstallRoot(scope: SourceScope): string | undefined {
@@ -1969,11 +1970,21 @@ export class DefaultPackageManager implements PackageManager {
}
private getTemporaryDir(prefix: string, suffix?: string): string {
const root = this.resolveManagedPath(join(tmpdir(), "pi-extensions"), prefix);
const hash = createHash("sha256")
.update(`${prefix}-${suffix ?? ""}`)
.digest("hex")
.slice(0, 8);
return join(tmpdir(), "pi-extensions", prefix, hash, suffix ?? "");
return this.resolveManagedPath(root, hash, suffix ?? "");
}
private resolveManagedPath(root: string, ...parts: string[]): string {
const resolvedRoot = resolve(root);
const resolvedPath = resolve(resolvedRoot, ...parts);
if (resolvedPath !== resolvedRoot && !resolvedPath.startsWith(`${resolvedRoot}${sep}`)) {
throw new Error(`Refusing to use path outside package install root: ${resolvedPath}`);
}
return resolvedPath;
}
private getBaseDirForScope(scope: SourceScope): string {