ucn 5.0.4 → 5.0.6

package/core/shared.js

@@ -2,9 +2,37 @@
  * core/shared.js - Shared utility functions used by both CLI and MCP server
  */
 
+const fs = require('fs');
+const path = require('path');
 const { isTestFile } = require('./discovery');
 const { detectLanguage } = require('./parser');
 
+/**
+ * Security containment check (fix #285): is `candidate` inside `root`?
+ *
+ * UCN only ever reads files it discovered under the project root. Any code
+ * path that resolves a caller-supplied path string (stack traces, handles)
+ * must gate the read on this before touching disk, or a crafted input like
+ * `File "/etc/passwd"` or `../../secret` exfiltrates arbitrary files through
+ * the tool surface (CLI and, more dangerously, the MCP tool agents call).
+ *
+ * Symlinks are followed via realpath so a link INSIDE the project cannot
+ * resolve to a target outside it. Non-existent candidates fall back to a
+ * lexical resolve — the caller still gates the read on existence.
+ * Comparison is boundary-correct: a sibling directory whose name merely
+ * shares the root's prefix (`/a/b` vs `/a/bee`) is not "inside".
+ */
+function isPathInsideRoot(root, candidate) {
+    if (!root || !candidate) return false;
+    let realRoot;
+    try { realRoot = fs.realpathSync(root); } catch { realRoot = path.resolve(root); }
+    let realCandidate;
+    try { realCandidate = fs.realpathSync(candidate); } catch { realCandidate = path.resolve(candidate); }
+    const rel = path.relative(realRoot, realCandidate);
+    return rel === '' ||
+        (rel !== '..' && !rel.startsWith('..' + path.sep) && !path.isAbsolute(rel));
+}
+
 /**
  * Code-unit string comparison (rule 11 / fix #227): output ordering is part
  * of the public contract and must be byte-identical across machines —
@@ -453,4 +481,5 @@ module.exports = {
     isOverrideMarked,
     hasTextBlindspots,
     countTextBlindspots,
+    isPathInsideRoot,
 };

package/core/stacktrace.js

@@ -7,6 +7,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { isPathInsideRoot } = require('./shared');
 
 /**
  * Calculate path similarity score between two file paths
@@ -85,9 +86,14 @@ function findBestMatchingFile(index, filePath, funcName, lineNum) {
     }
 
     if (candidates.length === 0) {
-        // Try absolute path
-        const absPath = path.isAbsolute(filePath) ? filePath : path.join(index.root, filePath);
-        if (fs.existsSync(absPath)) {
+        // A frame that matched no indexed file may still point at a real file
+        // inside the project the walker skipped (a build artifact, an ignored
+        // path). Resolve it and show it — but ONLY inside the project root.
+        // The frame path is caller-supplied and untrusted; without this gate
+        // `File "/etc/passwd"` or `../../secret` would exfiltrate arbitrary
+        // files through the tool surface (fix #285 — GHSA/issue #4).
+        const absPath = path.resolve(index.root, filePath);
+        if (isPathInsideRoot(index.root, absPath) && fs.existsSync(absPath)) {
             return {
                 path: absPath,
                 relativePath: path.relative(index.root, absPath),
@@ -160,6 +166,16 @@ function createStackFrame(index, filePath, lineNum, funcName, col, rawLine) {
     // Find the best matching file using improved algorithm
     const match = findBestMatchingFile(index, filePath, funcName, lineNum);
 
+    if (match && !isPathInsideRoot(index.root, match.path)) {
+        // Defense in depth: never read outside the project root even if a
+        // future matcher change returns such a path (fix #285). The frame is
+        // reported as located-but-unreadable rather than leaking content.
+        frame.matchedFile = match.relativePath;
+        frame.confidence = match.confidence;
+        frame.error = 'resolved outside project root; not read';
+        return frame;
+    }
+
     if (match) {
         const resolvedPath = match.path;
         frame.found = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ucn",
-  "version": "5.0.4",
+  "version": "5.0.6",
   "mcpName": "io.github.mleoca/ucn",
   "description": "Auditable AST code intelligence for AI agents: 18 task-oriented commands through one MCP tool, CLI, or agent skill. Supports JS/TS, Python, Go, Rust, Java, C, C++, C#, and HTML.",
   "main": "index.js",