Media Path Traversal Fix: Session-Scoped Root Binding & Sandboxing

Vulnerability Fix Summary: fix(media): bind local media roots to the active session Vulnerability Overview Problem Description: Media file read paths are not correctly bound to the current session, leading to potential path traversal or unauthorized access risks. Root Cause: 1. Source-parent expansion re-promoted shared parents: Source-parent expansion re-promoted shared parents, causing paths outside the session scope to be incorrectly treated as valid. 2. Attachment pipeline never received the session filter: The attachment processing pipeline never received the session filter, causing session defaults after cache merging to incorrectly fall back to shared parents. 3. Reply media staging ignored the sandbox access mode: Reply media staging ignored the sandbox access mode, causing non-mounted absolute paths to be incorrectly treated as valid. Impact Scope Affected Components: Media file reading, attachment processing pipeline, reply media staging. Risk Behaviors: Sandbox sessions may read files outside their sandbox. Shared host workspaces may be incorrectly accessed via the media pipeline. Paths outside the session scope may be incorrectly authorized. Fix Details Core Strategy: Strictly bind local media roots to the Active Session. Specific Remediation Measures: 1. Fail closed before bytes move: Fail closed before any byte movement. Reject paths stop at the boundary check, without staging or consuming bytes; media surfaces utilize the existing per-file "Delivery failed" path, avoiding silent drops. 2. Session-scoped roots are authoritative end-to-end: Session-scoped roots are authoritative end-to-end. The filtered root set is complete at read time; downstream media merging does not add what upstream removes. 3. workspaceAccess is the contract: serves as the contract. (default) → host workspace paths fail closed in sandbox sessions. / → workspace is mounted, and staging paths function correctly. 4. No config surface, no migration: No configuration surface changes and no migration required. No default behavior flips; legitimate paths (e.g., explicitly mounted workspaces, hosted media, external attachment parent expansions) are preserved and covered by tests. Verification Results: Real behavior: Verified. Captured production owner observations indicate that unmounted sandbox resolution, outbound staging, and cache reads succeed in isolation; authorized files succeed, while sandbox or unmounted workspace files are rejected before consumption. Evidence reviewed: 10 items. The current main branch still requires the fix; the acquired main branch still returns unconstrained source-parent expansion, after filesystem policy checks. It does not include the shared root constraint filter from the branch. Findings: None. Security: None. Pre-Merge Requirements: Resolve merge risk (P1): Third-party SDK callers relying on implicit sandbox source-parent expansion will lose authorized access until they repair to trust the active session context; each header security review accepts this bounded fix and the associated compatibility trade-off. Resolve merge risk (P1): This fix does not establish complete inbound host workspace isolation; regular inbound processing retains its existing caller workspace authorization, as explicitly scoped in the PR. Add data schema compatibility proof: Confirm migration or upgrade compatibility proof before merging.

Goal Reached Thanks to every supporter — we hit 100%!

Media Path Traversal Fix: Session-Scoped Root Binding & Sandboxing

More from this source