Security: Path traversal/arbitrary file write risk in parallel copy worker

[tuanaiseo]

Problem

Destination paths are created using path.join(destBase, relativePath) without validating that relativePath stays within destBase. If files contains ../ segments or absolute-like traversal payloads, writes can escape the intended directory and overwrite arbitrary files.

Severity: high
File: src/copy-worker.js

Solution

Normalize and validate each path before copy: resolve destination (path.resolve(destBase, relativePath)) and enforce it starts with path.resolve(destBase) + path.sep. Reject entries that fail this check.

Changes

• src/copy-worker.js (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced

[tomdps]

Status review (2026-07-29):

• Current main lacks a general destination-containment invariant: src/copy-worker.js:18-30 joins worker destinations and writes them without validating containment.
• Current supported tar/archive input provenance narrows demonstrated exploitability: no supported extractor feeds raw archive member paths into this copy pipeline; production names are local-directory readdirSync(..., { withFileTypes: true }) entries built in src/isolation-manager.js:969-1026.
• PR Security: Path traversal/arbitrary file write risk in parallel copy worker #468 is not merge-ready: its worker-only check misses the small-copy sink (src/isolation-manager.js:1047-1061), directory creation (src/isolation-manager.js:1028-1045), and an explicit symlink policy (src/isolation-manager.js:980-1002); containment must cover all destination-producing paths.