[P0] ZARA-013 — Confine agent file tools to explicit roots and block traversal/symlink escapes #14

New issue

Closed

opened 2026-07-18 19:20:29 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-18 19:20:29 +00:00

(Migrated from github.com)

Problem

zara/agent/tools/file_tools.py allows absolute paths and resolves relative paths without checking containment. ../ traversal and symlinks can escape the repository root. The LLM can read, overwrite, diff, or list arbitrary user files when tool calls are induced or misgenerated.

Required fix

Define explicit readable and writable roots in configuration.
Default repository tools to the repository root; do not allow arbitrary absolute paths by default.
Resolve paths and enforce containment after symlink resolution.
Reject symlinks, special files, directories for file operations, and writes outside allowed roots.
Use atomic writes and explicit overwrite policy.
Keep a separately named opt-in unrestricted mode only if required.

Required tests

Parent traversal, absolute path, symlink escape, nested symlink, broken symlink, directory, FIFO/device, overwrite, atomic-write failure, size limit, and Unicode path cases.
Add scripts/test-file-tools.sh using a temporary sandbox and an outside sentinel file.

Acceptance

The sentinel outside the configured root cannot be read, modified, or listed through a traversal alias.
Legitimate in-root operations continue to work.
Error messages identify policy rejection without leaking unnecessary data.

Branch

fix/zara-013-file-tool-sandbox

Dependencies

ZARA-008, ZARA-012.

## Problem `zara/agent/tools/file_tools.py` allows absolute paths and resolves relative paths without checking containment. `../` traversal and symlinks can escape the repository root. The LLM can read, overwrite, diff, or list arbitrary user files when tool calls are induced or misgenerated. ## Required fix - Define explicit readable and writable roots in configuration. - Default repository tools to the repository root; do not allow arbitrary absolute paths by default. - Resolve paths and enforce containment after symlink resolution. - Reject symlinks, special files, directories for file operations, and writes outside allowed roots. - Use atomic writes and explicit overwrite policy. - Keep a separately named opt-in unrestricted mode only if required. ## Required tests - Parent traversal, absolute path, symlink escape, nested symlink, broken symlink, directory, FIFO/device, overwrite, atomic-write failure, size limit, and Unicode path cases. - Add `scripts/test-file-tools.sh` using a temporary sandbox and an outside sentinel file. ## Acceptance - The sentinel outside the configured root cannot be read, modified, or listed through a traversal alias. - Legitimate in-root operations continue to work. - Error messages identify policy rejection without leaking unnecessary data. ## Branch `fix/zara-013-file-tool-sandbox` ## Dependencies ZARA-008, ZARA-012.