[security] Add path sandboxing to read_file/write_file tools #892

Closed

sleepy wants to merge 0 commits from fix/file-tool-sandboxing-676 into dev

sleepy commented

2026-06-04 02:14:50 +02:00

Owner

No description provided.

sleepy added 1 commit

2026-06-04 02:14:50 +02:00

[security] Add path sandboxing to read_file/write_file tools (#676 ) c38960276d

- Add validate_file_path() to src/tool_security.py
- Resolve paths to absolute (collapses .., follows symlinks)
- Block sensitive system dirs: /etc, /root, /proc, /sys, /dev
- Require resolved path within TOOL_SANDBOX_DIRS (defaults to cwd)
- TOOL_SANDBOX_DISABLE=1 bypasses checks for dev/test
- Wire validation into read_file and write_file in tool_execution.py
- 23 new tests covering blocked paths, traversal, sandbox config

sleepy referenced this pull request

2026-06-04 02:17:08 +02:00

[security] read_file/write_file tools have no path sandboxing or validation #676

sleepy closed this pull request

2026-06-04 02:17:12 +02:00