paseo-plugin-genui 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paseo-plugin-genui",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Paseo plugin: agents answer with charts, diagrams, maps, plans and forms rendered inline in the chat.",
   "keywords": [
     "paseo",

package/server/data-source.ts

@@ -1,5 +1,5 @@
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { mkdir, readdir, readFile, stat } from "node:fs/promises";
+import { constants, existsSync, readFileSync, readdirSync } from "node:fs";
+import { mkdir, open, readdir, readFile, realpath } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -47,9 +47,15 @@ type FileContent =
 
 type FileReader = (requested: string, maxBytes: number) => Promise<FileContent>;
 
+const AGENT_REFUSAL = "only files in this agent's workspace, its thread storage or /tmp can be loaded";
+const GALLERY_REFUSAL = "gallery specs can only load files in gallery/";
+
 function contains(root: string, target: string): boolean {
-  const relative = path.relative(path.resolve(root), path.resolve(target));
-  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+  const resolvedRoot = path.resolve(root);
+  const resolvedTarget = path.resolve(target);
+  if (resolvedRoot === resolvedTarget) return false;
+  const relative = path.relative(resolvedRoot, resolvedTarget);
+  return relative !== "" && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
 }
 
 export function agentStorageDir(agentId: string): string {
@@ -79,9 +85,58 @@ export async function resolveAgentCwd(paseo: PaseoApi, agentId: string): Promise
   }
 }
 
-async function readLocalFile(target: string, requested: string, maxBytes: number): Promise<FileContent> {
+interface Attempt {
+  readonly root: string;
+  readonly target: string;
+}
+
+type AttemptOutcome =
+  | { ok: true; content: string; encoding: "utf8" | "base64" }
+  | { ok: false; error: string; outsideRoot?: boolean };
+
+/**
+ * Resolves both `root` and `target` with `realpath` before checking containment,
+ * rejects any symlink or intermediate directory link that escapes `realRoot`,
+ * and reads from the validated canonical path with `O_NOFOLLOW`.
+ */
+async function readConfinedFile(
+  root: string,
+  target: string,
+  requested: string,
+  maxBytes: number,
+  refusalError: string,
+): Promise<AttemptOutcome> {
+  if (!contains(root, target)) {
+    return { ok: false, error: refusalError, outsideRoot: true };
+  }
+
+  let realRoot: string;
+  try {
+    realRoot = await realpath(root);
+  } catch {
+    return { ok: false, error: refusalError };
+  }
+
+  let realTarget: string;
+  try {
+    realTarget = await realpath(target);
+  } catch (cause) {
+    const code = typeof cause === "object" && cause !== null && "code" in cause ? cause.code : null;
+    if (code === "ENOENT" || code === "ENOTDIR") {
+      return { ok: false, error: "file not found" };
+    }
+    return { ok: false, error: cause instanceof Error ? cause.message : String(cause) };
+  }
+
+  if (!contains(realRoot, realTarget)) {
+    return { ok: false, error: refusalError, outsideRoot: true };
+  }
+
+  const openFlags = constants.O_RDONLY | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0);
+  let handle;
   try {
-    const info = await stat(target);
+    handle = await open(realTarget, openFlags);
+    const info = await handle.stat();
     if (!info.isFile()) return { ok: false, error: "not a regular file" };
     if (info.size > maxBytes) {
       return { ok: false, error: `${info.size} bytes is over the ${maxBytes}-byte limit` };
@@ -90,7 +145,7 @@ async function readLocalFile(target: string, requested: string, maxBytes: number
     const binary =
       (Object.hasOwn(IMAGE_TYPES, extension) && extension !== "svg") ||
       Object.hasOwn(AUDIO_TYPES, extension);
-    const content = await readFile(target);
+    const content = await handle.readFile();
     return binary
       ? { ok: true, content: content.toString("base64"), encoding: "base64" }
       : { ok: true, content: content.toString("utf8"), encoding: "utf8" };
@@ -100,9 +155,20 @@ async function readLocalFile(target: string, requested: string, maxBytes: number
       ok: false,
       error: code === "ENOENT" ? "file not found" : cause instanceof Error ? cause.message : String(cause),
     };
+  } finally {
+    await handle?.close().catch(() => undefined);
   }
 }
 
+function tempAttempts(target: string): Attempt[] {
+  if (contains("/private/tmp", target)) return [{ root: "/private/tmp", target }];
+  if (!contains("/tmp", target)) return [];
+  return [
+    { root: "/private/tmp", target: path.join("/private", target) },
+    { root: "/tmp", target },
+  ];
+}
+
 async function readAgentFile(
   paseo: PaseoApi,
   agentId: string,
@@ -113,50 +179,37 @@ async function readAgentFile(
   await mkdir(storageRoot, { recursive: true }).catch(() => undefined);
   const workspaceCwd = await resolveAgentCwd(paseo, agentId);
 
-  const candidates: string[] = [];
+  const inside = (root: string | null, target: string): Attempt[] =>
+    root !== null && contains(root, target) ? [{ root, target }] : [];
+
+  let attempts: Attempt[];
   if (requested.startsWith(BB_STORAGE_PREFIX)) {
     const rel = requested.slice(BB_STORAGE_PREFIX.length);
-    const target = path.resolve(storageRoot, rel);
-    if (contains(storageRoot, target)) candidates.push(target);
-    const galleryTarget = path.resolve(galleryDir(), rel);
-    if (contains(galleryDir(), galleryTarget)) candidates.push(galleryTarget);
+    attempts = inside(storageRoot, path.resolve(storageRoot, rel));
   } else if (requested.startsWith(PASEO_STORAGE_PREFIX)) {
     const rel = requested.slice(PASEO_STORAGE_PREFIX.length);
-    const target = path.resolve(storageRoot, rel);
-    if (contains(storageRoot, target)) candidates.push(target);
+    attempts = inside(storageRoot, path.resolve(storageRoot, rel));
   } else if (path.isAbsolute(requested)) {
     const target = path.resolve(requested);
-    if (
-      contains(storageRoot, target) ||
-      (workspaceCwd !== null && contains(workspaceCwd, target)) ||
-      contains("/tmp", target) ||
-      contains("/private/tmp", target)
-    ) {
-      candidates.push(target);
-    }
+    attempts = [...inside(storageRoot, target), ...inside(workspaceCwd, target)].slice(0, 1);
+    if (attempts.length === 0) attempts = tempAttempts(target);
   } else {
-    if (workspaceCwd !== null) {
-      const target = path.resolve(workspaceCwd, requested);
-      if (contains(workspaceCwd, target)) candidates.push(target);
-    }
-    const storageTarget = path.resolve(storageRoot, requested);
-    if (contains(storageRoot, storageTarget)) candidates.push(storageTarget);
-    const galleryTarget = path.resolve(galleryDir(), requested);
-    if (contains(galleryDir(), galleryTarget)) candidates.push(galleryTarget);
+    attempts = [
+      ...inside(workspaceCwd, workspaceCwd !== null ? path.resolve(workspaceCwd, requested) : ""),
+      ...inside(storageRoot, path.resolve(storageRoot, requested)),
+    ];
   }
 
-  if (candidates.length === 0) {
-    return {
-      ok: false,
-      error: "only files in this agent's workspace, its thread storage or /tmp can be loaded",
-    };
+  if (attempts.length === 0) {
+    return { ok: false, error: AGENT_REFUSAL };
   }
 
   let firstFailure: FileContent | undefined;
-  for (const candidate of candidates) {
-    const result = await readLocalFile(candidate, requested, maxBytes);
+  for (const attempt of attempts) {
+    const result = await readConfinedFile(attempt.root, attempt.target, requested, maxBytes, AGENT_REFUSAL);
     if (result.ok) return result;
-    firstFailure ??= result;
+    if (result.outsideRoot) return { ok: false, error: AGENT_REFUSAL };
+    firstFailure ??= { ok: false, error: result.error };
   }
   return firstFailure!;
 }
@@ -341,9 +394,10 @@ async function readGalleryFile(requested: string, maxBytes: number): Promise<Fil
     : requested;
   const target = path.resolve(root, clean);
   if (path.isAbsolute(clean) || !contains(root, target)) {
-    return { ok: false, error: "gallery specs can only load files in gallery/" };
+    return { ok: false, error: GALLERY_REFUSAL };
   }
-  return readLocalFile(target, clean, maxBytes);
+  const result = await readConfinedFile(root, target, clean, maxBytes, GALLERY_REFUSAL);
+  return result.ok ? result : { ok: false, error: result.error };
 }
 
 export function loadGalleryFile(requested: string, { raw = false }: { raw?: boolean } = {}): Promise<LoadedData> {

package/shared/genui.test.ts

@@ -1,4 +1,7 @@
+import { mkdir, rm, symlink, writeFile } from "node:fs/promises";
+import path from "node:path";
 import { describe, expect, it } from "vitest";
+import type { PaseoApi } from "@getpaseo/client";
 import {
   collectLoads,
   compile,
@@ -16,7 +19,14 @@ import {
   UI_REFERENCE_MORE,
 } from "./instructions";
 import { splitTimelineMessage } from "./segment";
-import { listGallery, loadGalleryFile, readGallerySpec } from "../server/data-source";
+import {
+  listGallery,
+  loadAgentAudio,
+  loadAgentFile,
+  loadAgentImage,
+  loadGalleryFile,
+  readGallerySpec,
+} from "../server/data-source";
 
 describe("paseo-plugin-genui core, instructions, and gallery", () => {
   it("compiles every example in the agent instructions cleanly", () => {
@@ -119,4 +129,54 @@ describe("paseo-plugin-genui core, instructions, and gallery", () => {
     expect(valid.ok).toBe(true);
     expect(valid.report).toContain("No errors.");
   });
+
+  it("refuses symlinks and intermediate directory links escaping the workspace root across data, image, and audio reads", async () => {
+    const testRoot = path.join("/tmp/opencode", `genui-symlink-test-${Date.now()}`);
+    const workspace = path.join(testRoot, "workspace");
+    const outside = path.join(testRoot, "outside");
+    await mkdir(workspace, { recursive: true });
+    await mkdir(outside, { recursive: true });
+
+    try {
+      const secretTxt = path.join(outside, "secret.txt");
+      const secretPng = path.join(outside, "secret.png");
+      const secretWav = path.join(outside, "secret.wav");
+      const insideTxt = path.join(workspace, "allowed.txt");
+      await writeFile(secretTxt, "top-secret-outside-line\n", "utf8");
+      await writeFile(secretPng, Buffer.from([0x89, 0x50, 0x4e, 0x47]));
+      await writeFile(secretWav, Buffer.from("RIFF0000WAVEfmt "));
+      await writeFile(insideTxt, "inside-workspace-line\n", "utf8");
+
+      await symlink(secretTxt, path.join(workspace, "report.txt"));
+      await symlink(secretPng, path.join(workspace, "report.png"));
+      await symlink(secretWav, path.join(workspace, "report.wav"));
+      await symlink(outside, path.join(workspace, "linked-dir"));
+
+      const mockPaseo = {
+        agents: {
+          ref: () => ({
+            current: () => ({ cwd: workspace }),
+            refresh: async () => ({ agent: { cwd: workspace }, project: null }),
+          }),
+        },
+      } as unknown as PaseoApi;
+
+      const allowed = await loadAgentFile(mockPaseo, "agent_symlink_test", "allowed.txt", { raw: true });
+      expect(allowed).toEqual({ ok: true, value: "inside-workspace-line\n" });
+
+      const directSymlink = await loadAgentFile(mockPaseo, "agent_symlink_test", "report.txt", { raw: true });
+      expect(directSymlink.ok).toBe(false);
+
+      const dirSymlink = await loadAgentFile(mockPaseo, "agent_symlink_test", "linked-dir/secret.txt", { raw: true });
+      expect(dirSymlink.ok).toBe(false);
+
+      const imageSymlink = await loadAgentImage(mockPaseo, "agent_symlink_test", "report.png");
+      expect(imageSymlink.ok).toBe(false);
+
+      const audioSymlink = await loadAgentAudio(mockPaseo, "agent_symlink_test", "report.wav");
+      expect(audioSymlink.ok).toBe(false);
+    } finally {
+      await rm(testRoot, { recursive: true, force: true });
+    }
+  });
 });