Skip to content

Path Boundaries: 18 Identical Fragile Checks

Evidence Level: F (directly proven by source code)
Analysis Baseline: 4f843556

TL;DR

18 instances of str(path).startswith(str(base)) in the codebase use the same fragile pattern—missing a path separator check, allowing sibling prefix bypass (e.g. abc123/ bypassed by abc123-evil/). No shared path-safety abstraction exists.

1. The Pattern

str(path).startswith(str(base))

This pattern fails in the following scenario:

  • base = "/workspace/abc123/", path = "/workspace/abc123-evil/etc/passwd"
  • startswith returns True—because abc123-evil does indeed start with abc123
  • The user/Agent can access files under abc123-evil, even though they shouldn't

The correct approach is to append a path separator to the comparison:

str(path).startswith(str(base) + os.sep)

2. Distribution

The 18 instances appear across the following modules:

Module Purpose
storage_runtime/local.py Local file read/write
storage_runtime/facade.py Storage facade
sandbox/config.py Sandbox path configuration
agent_tools.py File operations during tool execution
email_service.py Email attachment paths

The most dangerous scenario: email_service.py's send_email local fallback path—zero path validation, can directly access any file as an attachment.

3. No Shared Abstraction

The 18 calls are independent copy-paste instances, not encapsulated into a unified path-safety function (e.g. is_path_within_base(path, base)).

This means:

  • Fixing requires modifying each instance individually, with high risk of omission
  • No unit tests cover this security property
  • New code may continue to use the same fragile pattern

4. Relationship to AI Coding

  1. Copy-paste pattern: The AI independently generated the same path-check code in multiple tasks, each time using startswith, because it's "the most natural way to write it"
  2. No abstraction awareness: The AI won't proactively say "this pattern has appeared 18 times, it should be extracted into a shared function"—that requires an architect's holistic judgment
  3. Missing security awareness: startswith is semantically correct for string operations—the AI didn't realize that path separators matter for security semantics