security(v2.12): harden WhatsApp media paths and authorize before download #131

New issue

Open

opened 2026-09-09 14:58:54 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-09 14:58:54 +00:00

Owner

Upstream

Agent Zero v2.12 security fix: https://github.com/agent0ai/agent-zero/releases/tag/v2.12

Risk

The v2.12 release fixes WhatsApp media path traversal and moves sender/group authorization before media download. a0-symbolics carries the WhatsApp integration and must explicitly prove parity rather than assuming the bridge is safe.

Required work

Normalize and validate all inbound media filenames/paths before filesystem use.
Prevent .., absolute paths, separator tricks, encoded traversal, and symlink-assisted escape from the owned download root.
Perform sender/group authorization before requesting/downloading media bytes.
Ensure unauthorized messages cannot trigger network fetch, disk allocation, media parsing, or agent-visible attachment creation.
Preserve existing WhatsApp allow-list/group policy semantics.
Clean partial/failed media files only within plugin-owned temp/download state.

Acceptance

Traversal payloads cannot write/read outside the authorized WhatsApp media root.
Unauthorized senders/groups cause zero media download side effects.
Authorized media still downloads and reaches the normal handler.
Tests cover direct/encoded traversal, absolute paths, malicious filenames, symlink escape, unauthorized sender/group, and valid media.

## Upstream Agent Zero v2.12 security fix: https://github.com/agent0ai/agent-zero/releases/tag/v2.12 ## Risk The v2.12 release fixes WhatsApp media path traversal and moves sender/group authorization before media download. `a0-symbolics` carries the WhatsApp integration and must explicitly prove parity rather than assuming the bridge is safe. ## Required work - Normalize and validate all inbound media filenames/paths before filesystem use. - Prevent `..`, absolute paths, separator tricks, encoded traversal, and symlink-assisted escape from the owned download root. - Perform sender/group authorization before requesting/downloading media bytes. - Ensure unauthorized messages cannot trigger network fetch, disk allocation, media parsing, or agent-visible attachment creation. - Preserve existing WhatsApp allow-list/group policy semantics. - Clean partial/failed media files only within plugin-owned temp/download state. ## Acceptance - Traversal payloads cannot write/read outside the authorized WhatsApp media root. - Unauthorized senders/groups cause zero media download side effects. - Authorized media still downloads and reaches the normal handler. - Tests cover direct/encoded traversal, absolute paths, malicious filenames, symlink escape, unauthorized sender/group, and valid media.