mirror of https://github.com/ComposioHQ/composio.git synced 2026-09-22 11:46:35 +08:00

Files

T

Alberto Schiabel fc17c37bf9 fix(cli): enforce sensitive-file upload denylist (GHSA-hp3h-89pf-5q58) (#3763 )

This PR:

- fixes #3746 / GHSA-hp3h-89pf-5q58 — the CLI's tool file-upload path
bypassed the sensitive-file denylist
- **root cause:** the denylist was enforced at the *caller* layer, so
`@composio/cli`'s duplicate upload path (`readFileFromDisk`) read and
uploaded any local path a tool argument pointed at — `~/.ssh/id_rsa`,
`~/.aws/credentials`, `.env`, etc. — enabling credential exfiltration
via `composio execute` / `composio run` (incl. LLM-driven agents hit by
prompt injection)
- **unified fix:** one canonical guard, exported from `@composio/core`
and enforced at the read primitive in every SDK
- `core`: the guard now routes fs/path access through the internal
`#platform` abstraction (adds a `realpathSync` method), so it carries
**no static `node:*` imports** and is exported from the package root:
`assertSafeFileUploadPath`, `isBlockedSensitiveFileUploadPath`,
`BUILTIN_FILE_UPLOAD_PATH_DENY_SEGMENTS`
- `cli`: `readFileFromDisk` calls the shared `assertSafeFileUploadPath`
before `fs.readFile`; URLs and `File` objects are unaffected (matches
core)
- `python`: already routes all uploads through the guarded
`FileUploadable.from_path` — no functional change; adds regression tests
for parity
- supersedes #3755, which exported the then-node-only guard from core's
**main** `index.ts` and would have injected `node:fs` into the shared
`dist/index.mjs` (the workerd/edge-light entry), likely breaking
Cloudflare Workers / Vercel Edge
- changesets: `@composio/core` minor (new public exports),
`@composio/cli` patch (security fix)

## Verification

- core: full suite passes (997), incl. new root-export +
realpath-symlink cases
- **edge bundle stays clean**: built `dist/index.mjs` has no static
`node:*` imports and reaches the platform only via `#platform`
- cli: new regression test drives the real `uploadToolInputFiles →
readFileFromDisk → guard` chain — `~/.ssh/id_rsa` and `.env` throw
`ComposioSensitiveFilePathBlockedError` before any `createPresignedURL`
call; a normal file still uploads
- python: `test_files.py` + sensitive-path suite pass (145), incl. 3 new
`from_path` guard tests
- `tsgo` typecheck + eslint clean for core and cli

2026-07-07 00:30:40 +04:00

cli-file-upload-denylist.md

fix(cli): enforce sensitive-file upload denylist (GHSA-hp3h-89pf-5q58) (#3763 )

2026-07-07 00:30:40 +04:00

config.json

Release: update version (#3676 )

2026-06-25 18:54:17 -07:00

dependency-rollup.md

chore(deps): consolidate dependency updates (#3760 )

2026-07-06 14:33:55 +04:00

disable-retries-execute-proxy.md

fix(core): disable retries on non-idempotent tools.execute/proxyExecute (#3716 )

2026-06-30 21:53:46 +04:00

openai-parallel-tool-calls.md

fix(core): run all parallel OpenAI tool calls from the first choice (#3726 )

2026-07-02 13:27:49 +04:00

README.md

Add changesets

2025-05-19 19:30:29 +05:30

sensitive-file-upload-guard-shared.md

fix(cli): enforce sensitive-file upload denylist (GHSA-hp3h-89pf-5q58) (#3763 )

2026-07-07 00:30:40 +04:00

toolkit-version-case-insensitive.md

fix(sdk): resolve toolkit versions case-insensitively in both SDKs (#3762 )

2026-07-06 15:30:06 +04:00

triggers-create-user-id-resolution.md

fix(triggers): align create() user_id resolution across SDKs (#3723 )

2026-07-02 11:40:47 +04:00

README.md

Changesets

Hello and welcome! This folder has been automatically generated by @changesets/cli, a build tool that works with multi-package repos, or single-package repos to help you version and publish your code. You can find the full documentation for it in our repository

We have a quick list of common questions to get you started engaging with this project in our documentation