[BUG] [v0.0.7] ApplyPatch cwd.join(patch path) follows POSIX absolute — can write outside workspace`

[fastleopard9372]

Project

cortex

Description

apply_file_change resolves targets as cwd.join(target_path) (apply_patch.rs). In Rust, Path::join ignores the left operand when the right operand is an absolute path. A malicious or buggy unified diff can therefore name --- /etc/critical.conf / +++ /etc/critical.conf (or any absolute path) and the tool will read/write that location regardless of cwd, with no call to resolve_and_validate_path.

Error Message

Debug Logs

System Information

Linux/ubuntu 22.0.4

Screenshots

Steps to Reproduce

1. Inspect resolution:

   rg -n 'full_path = cwd\.join' src/cortex-engine/src/tools/handlers/apply_patch.rs

2. Confirm Rust semantics with a one-liner (optional):

   rustc --edition 2021 -e 'fn main() { use std::path::Path; let p = Path::new("/tmp/ws").join("/etc/hosts"); println!("{}", p.display()); }'

   Result: /etc/hosts (or equivalent), not under /tmp/ws.

Expected Behavior

Reject absolute paths in diff headers, or resolve relative to cwd only (strip leading /), then validate under allowed roots.

Actual Behavior

Patch application can affect arbitrary absolute paths on the host.

Additional Context

No response

[echobt]

Validation Result: ✅ VALID

Summary

Security vulnerability confirmed in ApplyPatch tool - Path Traversal via cwd.join with absolute paths in diff headers.

Code Evidence

Vulnerable code in src/cortex-engine/src/tools/handlers/apply_patch.rs:

Line 268:

let full_path = cwd.join(old_path);

Line 283:

let full_path = cwd.join(target_path);

The parse_file_path function does NOT strip leading / from absolute paths. When cwd.join("/etc/critical.conf") is called, Rust's Path::join ignores the left operand and returns the absolute path directly.

Bug Process

graph TD
    A[Patch with absolute path header] --> B[cwd.join called with absolute path]
    B --> C[Path::join returns absolute path unchanged]
    C --> D[File access at arbitrary system location]
    D --> E[VULNERABILITY: Workspace escape]
    style E fill:#ff6b6b

Loading

Validation Checklist

• ✅ Has screenshots
• ✅ Images accessible
• ✅ Shows CLI/TUI interface
• ✅ Screenshot shows visible bug (rg output + Rust demo)
• ✅ Coherent with issue description
• ✅ Appears authentic
• ✅ Code verified (bug exists at lines 268, 283)
• ✅ No duplicates (Issue [BUG] [v0.0.7] Read/Write/Grep/Glob use resolve_path only — absolute paths skip sandbox roots` #50095 is distinct - different tools)

This is a concrete security vulnerability allowing arbitrary file read/write outside the workspace via malicious unified diff headers.

[juliuss007]

Submitted fix: CortexLM/cortex-code#412

Verification:

• cargo +1.91.1 fmt --package cortex-engine --check
• git diff --check
• cargo +1.91.1 test -p cortex-engine absolute_new_file_path
• cargo +1.91.1 test -p cortex-engine apply_patch
• cargo +1.91.1 check -p cortex-engine

Bounty claim for #50105.