Proudlock 2ce4fa4e5c Security: Add path traversal protection to plugin operations ...

Add defense-in-depth validation to prevent path traversal attacks when
enabling/installing plugins via the UI or CLI.

Layer 1 - Input Validation (enable_plugin):
- Validate plugin names with regex ^[a-zA-Z0-9_-]+$
- Reject reserved names (., .., empty string)
- Blocks attempts like ../../../etc/passwd at entry point

Layer 2 - Path Boundary Check (load_manifest):
- Verify resolved manifest path stays within plugins_dir
- Defense in depth even if name validation is bypassed
- Compatible with Python 3.8+ (fallback for < 3.9)

Risk Assessment: LOW
- Requires admin role (already trusted)
- Multiple existing validation layers
- No known exploitation in the wild

Rationale: Defense in depth best practice. Admins are trusted, but input
validation should not rely solely on authorization checks.

Tested:
- Valid names pass (backups, my-plugin, plugin-name)
- Path traversal blocked (../../../etc/passwd)
- Reserved names blocked (..)
- Both validation layers confirmed working

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2026-09-07 03:01:09 -04:00

26 KiB

Raw Blame History

View Raw