CodeQL reopens personal-directory path-injection false positives after adjacent edits

[RaresKeY]

Prerequisites

• I searched open issues, open pull requests, and discussions and did not find an exact report for this recurring personal-directory alert.
• This is not a security vulnerability. The affected HTTP path is already confined at runtime; this report is about making that guard visible to CodeQL so unrelated edits do not reopen the same false positive.
• This reproduces on the latest dev branch.

Install Method

Other (GitHub-hosted Actions / the repository's advanced CodeQL workflow)

Operating System

Linux

Steps to Reproduce

1. On current dev, inspect the personal-directory indexing flow from routes/personal_routes.py to src/rag_vector.py::index_personal_documents.
2. The admin-only route resolves the requested directory with os.path.realpath() and confines it under PERSONAL_DIR with os.path.commonpath() before passing it to the filesystem walk.
3. Make a behavior-preserving edit at the existing os.walk(directory) site, such as exposing the dirs tuple element so the walk can prune selected directories.
4. Open a PR and let the Python CodeQL job run.

Expected Behaviour

The normalized safe-root check should be recognized as a barrier for the user-derived directory before it reaches os.walk(). A behavior-preserving edit at the downstream walk should not create a new high-severity py/path-injection alert for the same already-confined flow.

Actual Behaviour

The dismissed dev finding and the PR finding were tracked as separate alerts:

• alert Keep Cookbook serve preflight errors visible #398 was dismissed as a false positive for the current dev flow;
• alert feat: Add plan mode to the chat agent #638 was opened for PR fix(rag): skip hidden and junk directories when indexing #5633 after its walk changed from ignoring the directory list to using it for in-place pruning;
• alert feat: Add plan mode to the chat agent #638 pointed to the same route parameter and downstream walk, even though the PR added no unconfined caller and did not weaken the route guard.

Alert #638 has since also been dismissed as a false positive. The underlying source shape still uses commonpath(), so another nearby edit can repeat the triage cycle.

Logs / Screenshots

CodeQL 2.26.1
Rule: py/path-injection
Dev alert: #398 (dismissed false positive)
PR #5633 alert: #638 (dismissed false positive)
Sink: src/rag_vector.py::index_personal_documents -> os.walk(directory)

Model / Backend (if relevant)

N/A

Are you willing to submit a fix?

Yes — I can open a PR

Additional Information

A narrow fix can keep realpath() symlink resolution and apply an explicit startswith() guard in each request-to-sink route, followed by an exact-root or separator-delimited descendant check. Direct regressions can cover both add/remove routes, exact-root and descendant acceptance, and parent, sibling-prefix, and symlink-escape rejection. This follows CodeQL's documented normalize-then-prefix-check pattern without disabling the query, filtering SARIF, excluding the file, or lowering the alert severity.

Related work:

• Proposal: CI baseline (correctness + security) gate for the repo #2288 tracks the broader CI/security-gate direction.
• security: make research path confinement visible to CodeQL #5128 and merged PR fix(security): make research path lookup CodeQL-friendly #5129 handled the analogous need to make research-path confinement visible to CodeQL.
• PR fix(rag): skip hidden and junk directories when indexing #5633 exposed this recurrence while changing personal-document walk pruning; the false-positive flow predates that PR.