golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #3626 from gsd-build/fix/3589-bug-security-sdk-planningpaths-accepts-u

Browse Source 
fix(3589)(security): validate workstream in relPlanningPath against traversal
This commit is contained in:
Tom Boucher
2026-05-15 23:04:13 -04:00
committed by GitHub
parent 66a429adf4 11a6d3fdd6
commit 8b31739a01
3 changed files with 109 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/3589-planning-paths-workstream-validation.md Normal file
View File

@@ -0,0 +1,5 @@
---
type: Security
issue: 3589
---
**`relPlanningPath()` now validates explicit workstream names** — direct SDK callers passing a workstream argument to `relPlanningPath`, `planningPaths`, or `ContextEngine` previously had no path-traversal gate. A value like `'../../../outside'` flowed through `posix.join('.planning', 'workstreams', name)` and routed planning operations outside the intended `.planning/workstreams/<name>` subtree. The fix runs the shared `validateWorkstreamName` policy inside `relPlanningPath` so every consumer fails closed at the same seam. Env-sourced workstreams continue to fall back silently to root `.planning/` per the #2791 contract (they are filtered to `null` by `planningPaths` before reaching `relPlanningPath`).