From 4dc705db3c67bf1749d86ece329b11ed0d2869f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=A8=8B=E5=BA=8F=E5=91=98=E9=98=BF=E6=B1=9F=28Relakkes?= =?UTF-8?q?=29?= Date: Fri, 22 May 2026 19:48:05 +0800 Subject: [PATCH] fix: allow selected workspaces in filesystem browser Desktop file mentions should follow the workspace the user opened, but the filesystem browser only trusted the home and temp roots. Register workspace roots after repository context, session creation, and session git-info resolution so Windows projects on another drive can be searched without turning the browse API into arbitrary disk access. Constraint: Windows users can open repositories outside C:\\Users, such as D:\\workspace\\code\\cc-haha Constraint: Filesystem browse must not become an unbounded local disk reader Rejected: Add a global user-configurable filesystem whitelist | broader product and persistence surface than this bug needs Rejected: Allow every requested browse path | would bypass the intended filesystem boundary Confidence: high Scope-risk: moderate Directive: Register only workspace roots that the server has already resolved through session or repository flows Tested: bun test src/server/__tests__/filesystem.test.ts Tested: bun run check:server Not-tested: Windows packaged desktop smoke --- src/server/__tests__/filesystem.test.ts | 62 +++++++++++++++++++ src/server/api/filesystem.ts | 5 ++ src/server/api/sessions.ts | 8 ++- src/server/services/filesystemAccessRoots.ts | 30 +++++++++ .../services/repositoryLaunchService.ts | 4 ++ src/server/services/sessionService.ts | 2 + 6 files changed, 110 insertions(+), 1 deletion(-) create mode 100644 src/server/services/filesystemAccessRoots.ts diff --git a/src/server/__tests__/filesystem.test.ts b/src/server/__tests__/filesystem.test.ts index 0e2ffdc2..6c3d0c3a 100644 --- a/src/server/__tests__/filesystem.test.ts +++ b/src/server/__tests__/filesystem.test.ts @@ -5,6 +5,8 @@ import * as fsp from 'fs/promises' import * as os from 'os' import * as path from 'path' import { handleFilesystemRoute } from '../api/filesystem.js' +import { clearFilesystemAccessRootsForTests } from '../services/filesystemAccessRoots.js' +import { getRepositoryContext } from '../services/repositoryLaunchService.js' const cleanupDirs = new Set() @@ -21,6 +23,7 @@ afterEach(async () => { await fsp.rm(dir, { recursive: true, force: true }) } cleanupDirs.clear() + clearFilesystemAccessRootsForTests() }) function git(cwd: string, ...args: string[]): string { @@ -30,6 +33,34 @@ function git(cwd: string, ...args: string[]): string { }) } +function isWithinPath(targetPath: string, rootPath: string): boolean { + const target = path.resolve(targetPath) + const root = path.resolve(rootPath) + return target === root || target.startsWith(`${root}${path.sep}`) +} + +async function makeExternalFixtureDir(): Promise { + const candidates = ['/var/tmp', '/private/var/tmp', '/Users/Shared'] + + for (const baseDir of candidates) { + try { + const stat = await fsp.stat(baseDir) + if (!stat.isDirectory()) continue + const fixtureDir = await fsp.mkdtemp(path.join(baseDir, 'claude-filesystem-test-')) + const isDefaultAllowed = + isWithinPath(fixtureDir, os.homedir()) || + isWithinPath(fixtureDir, '/tmp') || + (process.platform === 'darwin' && isWithinPath(fixtureDir, '/private/tmp')) + if (!isDefaultAllowed) return fixtureDir + await fsp.rm(fixtureDir, { recursive: true, force: true }) + } catch { + // Try the next common writable system directory. + } + } + + return null +} + describe('filesystem API', () => { it('allows browsing a directory under the user home directory', async () => { const homeFixtureDir = await fsp.mkdtemp(path.join(os.homedir(), 'claude-filesystem-test-')) @@ -49,6 +80,37 @@ describe('filesystem API', () => { expect(body.entries.some((entry) => entry.name === 'note.txt')).toBe(true) }) + it('allows browsing a selected workspace outside the default home/tmp roots', async () => { + const externalFixtureDir = await makeExternalFixtureDir() + if (!externalFixtureDir) return + + cleanupDirs.add(externalFixtureDir) + await fsp.writeFile(path.join(externalFixtureDir, 'note.txt'), 'hello') + + const deniedRes = await handleFilesystemRoute( + '/api/filesystem/browse', + makeUrl('/api/filesystem/browse', { + path: externalFixtureDir, + includeFiles: 'true', + }), + ) + expect(deniedRes.status).toBe(403) + + await getRepositoryContext(externalFixtureDir) + + const res = await handleFilesystemRoute( + '/api/filesystem/browse', + makeUrl('/api/filesystem/browse', { + path: externalFixtureDir, + includeFiles: 'true', + }), + ) + + expect(res.status).toBe(200) + const body = await res.json() as { entries: Array<{ name: string }> } + expect(body.entries.some((entry) => entry.name === 'note.txt')).toBe(true) + }) + it('fuzzy searches files and directories below the selected root', async () => { const homeFixtureDir = await fsp.mkdtemp(path.join(os.homedir(), 'claude-filesystem-test-')) cleanupDirs.add(homeFixtureDir) diff --git a/src/server/api/filesystem.ts b/src/server/api/filesystem.ts index 97f68676..62426079 100644 --- a/src/server/api/filesystem.ts +++ b/src/server/api/filesystem.ts @@ -12,6 +12,7 @@ import { execFileNoThrowWithCwd } from '../../utils/execFileNoThrow.js' import { findGitRoot, gitExe } from '../../utils/git.js' import { ripGrep } from '../../utils/ripgrep.js' import { getInitialSettings } from '../../utils/settings/settings.js' +import { isWithinRegisteredFilesystemRoot } from '../services/filesystemAccessRoots.js' type FilesystemEntry = { name: string @@ -57,6 +58,10 @@ function isAllowedFilesystemPath(targetPath: string): boolean { return true } + if (isWithinRegisteredFilesystemRoot(resolvedPath)) { + return true + } + // macOS reports /tmp as /private/tmp via native folder pickers and realpath(). if (process.platform === 'darwin' && isWithinRoot(resolvedPath, '/private/tmp')) { return true diff --git a/src/server/api/sessions.ts b/src/server/api/sessions.ts index c1bff8c9..e404d1fe 100644 --- a/src/server/api/sessions.ts +++ b/src/server/api/sessions.ts @@ -38,6 +38,7 @@ import { createSessionBranch, SessionBranchingError, } from '../../utils/sessionBranching.js' +import { registerFilesystemAccessRoot } from '../services/filesystemAccessRoots.js' const workspaceService = new WorkspaceService( async (sessionId) => ( @@ -314,7 +315,11 @@ async function getSessionRepositoryContext(url: URL): Promise { throw ApiError.badRequest('workDir query parameter is required') } - return Response.json(await getRepositoryContext(workDir)) + const context = await getRepositoryContext(workDir) + registerFilesystemAccessRoot(workDir) + registerFilesystemAccessRoot(context.workDir) + registerFilesystemAccessRoot(context.repoRoot) + return Response.json(context) } async function requireSessionWorkspace(sessionId: string): Promise { @@ -633,6 +638,7 @@ async function getGitInfo(sessionId: string): Promise { if (!workDir) { throw ApiError.notFound(`Session not found: ${sessionId}`) } + registerFilesystemAccessRoot(workDir) const launchInfo = await sessionService.getSessionLaunchInfo(sessionId).catch(() => null) const repository = launchInfo?.repository const worktreeSession = launchInfo?.worktreeSession diff --git a/src/server/services/filesystemAccessRoots.ts b/src/server/services/filesystemAccessRoots.ts new file mode 100644 index 00000000..a77ace6b --- /dev/null +++ b/src/server/services/filesystemAccessRoots.ts @@ -0,0 +1,30 @@ +import * as path from 'node:path' + +const registeredRoots = new Set() + +function normalizeComparablePath(filePath: string): string { + const resolved = path.resolve(filePath) + return process.platform === 'win32' ? resolved.toLowerCase() : resolved +} + +function isWithinRoot(targetPath: string, rootPath: string): boolean { + const target = normalizeComparablePath(targetPath) + const root = normalizeComparablePath(rootPath) + return target === root || target.startsWith(`${root}${path.sep}`) +} + +export function registerFilesystemAccessRoot(rootPath: string | null | undefined): void { + if (!rootPath) return + registeredRoots.add(path.resolve(rootPath)) +} + +export function isWithinRegisteredFilesystemRoot(targetPath: string): boolean { + for (const rootPath of registeredRoots) { + if (isWithinRoot(targetPath, rootPath)) return true + } + return false +} + +export function clearFilesystemAccessRootsForTests(): void { + registeredRoots.clear() +} diff --git a/src/server/services/repositoryLaunchService.ts b/src/server/services/repositoryLaunchService.ts index 7b7825bf..03a546e8 100644 --- a/src/server/services/repositoryLaunchService.ts +++ b/src/server/services/repositoryLaunchService.ts @@ -4,6 +4,7 @@ import * as path from 'node:path' import { promisify } from 'node:util' import { ApiError } from '../middleware/errorHandler.js' import { findCanonicalGitRoot, findGitRoot } from '../../utils/git.js' +import { registerFilesystemAccessRoot } from './filesystemAccessRoots.js' import { ensureWorktreesDirExcluded, performPostCreationSetup, @@ -326,6 +327,8 @@ export async function getRepositoryContext(workDir: string): Promise