test: cover env path containment

Fix: Fix Path Traversal in cli.py
2026-08-28 18:59:42 +02:00 · 2026-07-19 23:31:19 +00:00 · 2026-07-09 03:15:53 +00:00
2 changed files with 14 additions and 1 deletions
@@ -509,7 +509,12 @@ def _resolve_env_path(
    if isinstance(env_field, dict) and env_field:
        return None
    if isinstance(env_field, str):
-        env_path = (config_path.parent / env_field).resolve()
+        project_root = config_path.parent.resolve()
+        env_path = (project_root / env_field).resolve()
+        if not env_path.is_relative_to(project_root):
+            raise click.UsageError(
+                f"env file '{env_field}' specified in langgraph.json resolves outside the project directory."
+            )
        if not env_path.exists():
            _get_emitter().note(
                f"Warning: env file '{env_field}' specified in langgraph.json not found."
@@ -227,6 +227,14 @@ class TestResolveEnvPath:
        resolved = _resolve_env_path({"env": "custom.env"}, config_path)
        assert resolved == env_file.resolve()

+    @pytest.mark.parametrize("env_field", ["../outside.env", "/etc/passwd"])
+    def test_env_path_outside_project_raises(self, tmp_path, env_field):
+        config_path = tmp_path / "langgraph.json"
+        config_path.touch()
+
+        with pytest.raises(click.UsageError, match="resolves outside the project"):
+            _resolve_env_path({"env": env_field}, config_path)
+
    def test_missing_env_file_returns_none(self, tmp_path):
        config_path = tmp_path / "langgraph.json"
        config_path.touch()
Author	SHA1	Message	Date
John Kennedy	52ba71ad60	test: cover env path containment	2026-07-19 23:31:19 +00:00
corridor-security[bot]andGitHub	cd05fec1bc	Fix: Fix Path Traversal in cli.py	2026-07-09 03:15:53 +00:00