molecule-ai/molecule-core
39
0
Fork 2
Code Issues 46 Pull Requests 33 Actions 10 Packages Projects Releases Wiki Activity

fix(security#321): path traversal guard in loadWorkspaceEnv (CWE-22) #324

Closed
core-be wants to merge 2 commits from fix/sec-321-path-traversal into main
pull from: fix/sec-321-path-traversal
merge into: molecule-ai:main
Conversation 3 Commits 2 Files Changed 4 +193 -35

2 Commits

Author SHA1 Message Date
Molecule AI Core-BE
018a9acf1c fix(security#321): path traversal guard in loadWorkspaceEnv (CWE-22)
Some checks failed
sop-tier-check / tier-check (pull_request) Failing after 2s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 2s
Details
audit-force-merge / audit (pull_request) Has been skipped
Details 
CWE-22: Path traversal in loadWorkspaceEnv (org_helpers.go). A malicious
org YAML setting filesDir to "../../../etc" caused filepath.Join to
escape the org root and read an arbitrary .env file.

Guard: resolveInsideRoot(orgBaseDir, filesDir) — already used at
org_import.go:327 for the same ws.FilesDir input. On traversal rejection,
log and return only the org-root env vars (silent — callers expect
empty map on read failure). No caller changes needed.

Tests: 6 new cases in org_path_test.go covering:
- Normal load (org root + workspace override)
- Traversal attempt rejected (../escape-target)
- Deep traversal rejected (10× "../")
- Empty filesDir loads org root only
- Non-existent filesDir is silent no-op
- Empty orgBaseDir returns empty map

Fixes: #321

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-10 13:51:12 +00:00
Molecule AI Core-BE
768578b03a fix(QA-audit #307 #308): asyncio lifecycle fix + push-mode queue test coverage
Some checks failed
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 1s
Details
sop-tier-check / tier-check (pull_request) Failing after 1s
Details 
Issue #307 (regression, medium):
- test_a2a_tools_inbox_wrappers.py: replace _run() helper that called
  asyncio.get_event_loop().run_until_complete() — bypasses
  pytest-asyncio lifecycle, causing 14 tests to pass in isolation but
  exit-1 in full suite. Convert all test methods to
  @pytest.mark.asyncio async def / await.

Issue #308 (test gap, low):
- test_a2a_response.py: push-mode queue handling (PR #278, a2a_proxy.go
  push-at-capacity path) had no dedicated tests despite ~17 uncovered
  lines. Add 3 fixtures (push_queued_full/notify/no_method), 4 test
  cases covering classification, method field, method sentinel, and
  queue_id log output. Also add adversarial inputs for
  queued="yes" (string) and queued=False to confirm is True check.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-10 13:37:51 +00:00