WEBDIENSTE/langgraph
1
0
Fork 0
mirror of https://github.com/langchain-ai/langgraph.git synced 2026-09-06 09:47:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Fix Path Traversal in cli.py

Browse Source
This commit is contained in:
corridor-security[bot]
2026-07-09 03:15:53 +00:00
committed by GitHub
parent 23652c54be
commit cd05fec1bc
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/cli/langgraph_cli/deploy.py
+6 -1
View File
@@ -509,7 +509,12 @@ def _resolve_env_path(
if isinstance(env_field, dict) and env_field:
return None
if isinstance(env_field, str):
env_path = (config_path.parent / env_field).resolve()
project_root = config_path.parent.resolve()
env_path = (project_root / env_field).resolve()
if not env_path.is_relative_to(project_root):
raise click.UsageError(
f"env file '{env_field}' specified in langgraph.json resolves outside the project directory."
)
if not env_path.exists():
_get_emitter().note(
f"Warning: env file '{env_field}' specified in langgraph.json not found."