software-mansion__argent

mirror of https://github.com/software-mansion/argent.git synced 2026-09-14 19:27:14 +08:00

Files

T

History

Ignacy Łątka 03325e518f fix(flows): validate name to close path-traversal in getFlowPath

The unsanitized `name` parameter was joined into
  <project_root>/.argent/flows/<name>.yaml
so a name like "../../../tmp/x" landed the YAML file at an
attacker-chosen path. Combined with the no-auth/wildcard-CORS HTTP
surface, a cross-origin browser POST could write attacker-controlled
YAML anywhere the user can write — .github/workflows/*.yaml,
docker-compose.yml, etc.

Adds assertSafeFlowName() in flow-utils.ts. getFlowPath() now requires
^[A-Za-z0-9_\-]+$ (letters, digits, underscore, hyphen — no separators,
no "..", no spaces) and additionally checks that the resolved path
stays inside the flows directory via path.relative.

Centralizing the check in getFlowPath() means every caller
(flow-start-recording, flow-add-step, flow-insert-echo,
flow-finish-recording, flow-run, flow-read-prerequisite) is covered
without per-tool churn.

2026-05-07 15:14:39 +02:00

argent

chore: bump package versions to 0.6.0 (#178 )

2026-04-30 16:02:33 +02:00

argent-cli

chore: bump package versions to 0.6.0 (#178 )

2026-04-30 16:02:33 +02:00

argent-installer

fix installer update version detection under npx (#188 )

2026-05-06 16:47:56 +02:00

argent-mcp

chore: bump package versions to 0.6.0 (#178 )