fix(kb): enforce per-user component path containment (#14065)

* fix(kb): enforce per-user path containment

* fix(security): protect Docling Serve outbound requests (#14033)

* fix(security): protect Docling Serve requests

* fix(docling): support Self on Python 3.10

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix(auth): verify current password on password changes (#14034)

* fix(security): harden MCP stdio configuration (#14036)

* fix(security): restrict MCP stdio package sources

* fix(security): block MCP Docker host access

* fix(security): validate embedded MCP stdio configs

* fix: require executable-only MCP commands

* test: use allowed MCP commands in timeout tests

* fix(security): harden component code module access (#14032)

* fix(security): harden component code module access

* fix(security): block native FFI imports in generated code

* fix: track module assignment aliases in code scanner

* fix(security): address alias review findings

* fix: correct deprecated model settings behavior (#14047)

* fix: prevent deprecated model enablement

* test: use supported model in credential cleanup

* fix(voice): enforce flow authorization on websocket (#14043)

* fix(security): block native FFI imports in generated code (#14040)

* fix(security): block native FFI imports in generated code

* fix: track module assignment aliases in code scanner

* chore: resolve code security conflicts

* fix(security): confine AssemblyAI audio file access (#14037)

* fix(security): confine AssemblyAI audio file access

* [autofix.ci] apply automated fixes

* test: stub optional AssemblyAI dependency

* fix(security): harden AssemblyAI file submission

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* fix: track assignment aliases in component code scanner (#14041)

fix: bind loop and comprehension aliases

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: erichare

src/backend/base/langflow/initial_setup/starter_projects/Knowledge Retrieval.json

@@ -106,6 +106,16 @@ def test_validate_column_config_invalid_column(self, component_class, default_kw
         with pytest.raises(ValueError, match="Column 'nonexistent' not found in DataFrame"):
             component._validate_column_config(data_df)
 
+    @pytest.mark.parametrize("knowledge_base", ["../../outside", "../victim/secret_kb"])
+    async def test_kb_path_rejects_paths_outside_the_current_user_directory(
+        self, component_class, default_kwargs, knowledge_base
+    ):
+        default_kwargs["knowledge_base"] = knowledge_base
+        component = component_class(**default_kwargs)
+
+        with pytest.raises(ValueError, match="KB path escapes root directory"):
+            await component._kb_path()
+
     def test_new_knowledge_dialog_uses_provider_credentials(self, component_class, default_kwargs):
         """Test the create-knowledge dialog no longer exposes a redundant API key override."""
         component = component_class(**default_kwargs)

src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json

@@ -308,6 +308,48 @@ def test_retrieval_module_reexports_filter_helpers(self) -> None:
         assert _chunk_matches_filter(None, {}) is True
 
 
+# ---------------------------------------------------------------------------
+# Knowledge Base path isolation
+# ---------------------------------------------------------------------------
+class TestKnowledgeBasePathIsolation:
+    @pytest.mark.parametrize(
+        "component_class",
+        [KnowledgeComponent, KnowledgeIngestionComponent, KnowledgeBaseComponent],
+    )
+    @pytest.mark.parametrize("knowledge_base", ["../../outside", "../victim/secret_kb"])
+    def test_rejects_kb_names_outside_the_current_user_directory(
+        self, component_class, knowledge_base, tmp_path
+    ) -> None:
+        component = component_class(knowledge_base=knowledge_base)
+
+        with pytest.raises(ValueError, match="KB path escapes root directory"):
+            component._resolve_kb_path(tmp_path, "attacker", knowledge_base)
+
+    def test_rejects_username_that_escapes_the_global_kb_root(self, tmp_path) -> None:
+        component = KnowledgeComponent(knowledge_base="safe_kb")
+
+        with pytest.raises(ValueError, match="KB path escapes root directory"):
+            component._resolve_kb_path(tmp_path, "../outside", "safe_kb")
+
+    def test_rejects_symlink_escape_from_current_user_directory(self, tmp_path) -> None:
+        user_root = tmp_path / "attacker"
+        outside_root = tmp_path.parent / "outside"
+        user_root.mkdir()
+        outside_root.mkdir(exist_ok=True)
+        (user_root / "linked").symlink_to(outside_root, target_is_directory=True)
+        component = KnowledgeComponent(knowledge_base="linked/secret_kb")
+
+        with pytest.raises(ValueError, match="KB path escapes root directory"):
+            component._resolve_kb_path(tmp_path, "attacker", "linked/secret_kb")
+
+    def test_preserves_kb_names_inside_the_current_user_directory(self, tmp_path) -> None:
+        component = KnowledgeComponent(knowledge_base="existing_kb")
+
+        assert component._resolve_kb_path(tmp_path, "current_user", "existing_kb") == (
+            tmp_path / "current_user" / "existing_kb"
+        )
+
+
 # ---------------------------------------------------------------------------
 # Display name / dropdown UX (matches starter projects + frontend create dialog)
 # ---------------------------------------------------------------------------

src/backend/tests/unit/components/files_and_knowledge/test_ingestion.py

@@ -373,6 +373,21 @@ async def test_retrieve_data_missing_user_record_raises(self, component_class, d
             with pytest.raises(ValueError, match=r"User with ID .* not found"):
                 await component.retrieve_data()
 
+    @pytest.mark.parametrize("knowledge_base", ["../../outside", "../victim/secret_kb"])
+    async def test_retrieve_data_rejects_paths_outside_the_current_user_directory(
+        self, component_class, default_kwargs, knowledge_base
+    ):
+        default_kwargs["knowledge_base"] = knowledge_base
+        component = component_class(**default_kwargs)
+
+        with (
+            patch.object(component, "_get_kb_metadata") as mock_get_metadata,
+            pytest.raises(ValueError, match="KB path escapes root directory"),
+        ):
+            await component.retrieve_data()
+
+        mock_get_metadata.assert_not_called()
+
     async def test_retrieve_data_routes_query_with_scores(
         self,
         component_class,

src/backend/tests/unit/components/files_and_knowledge/test_knowledge.py

@@ -543,7 +543,9 @@ async def update_build_config(
                     msg = f"Embedding validation failed: {e!s}"
                     raise ValueError(msg) from e
 
-                kb_path = _get_knowledge_bases_root_path() / kb_user / field_value["01_new_kb_name"]
+                kb_path = self._resolve_kb_path(
+                    _get_knowledge_bases_root_path(), kb_user, field_value["01_new_kb_name"]
+                )
                 kb_path.mkdir(parents=True, exist_ok=True)
 
                 build_config["knowledge_base"]["value"] = field_value["01_new_kb_name"]
@@ -594,6 +596,19 @@ def _get_kb_root(self) -> Path:
         """Return the root directory for knowledge bases."""
         return _get_knowledge_bases_root_path()
 
+    @staticmethod
+    def _resolve_kb_path(kb_root: Path, kb_user: str, kb_name: str) -> Path:
+        """Resolve the selected KB inside the authenticated user's directory."""
+        # Lazy import keeps lfx importable without langflow's DB services.
+        from langflow.services.memory_base.kb_path_helpers import validate_kb_path
+
+        user_root = kb_root / kb_user
+        validate_kb_path(kb_root, user_root)
+
+        kb_path = user_root / kb_name
+        validate_kb_path(user_root, kb_path)
+        return kb_path
+
     @staticmethod
     def _scalar_notna(value) -> bool:
         """Check if a value is not NA, safely handling arrays and sequences.
@@ -1119,7 +1134,7 @@ async def _kb_path(self) -> Path | None:
 
         kb_root = self._get_kb_root()
 
-        self._cached_kb_path = kb_root / kb_user / self.knowledge_base
+        self._cached_kb_path = self._resolve_kb_path(kb_root, kb_user, self.knowledge_base)
 
         return self._cached_kb_path
 
@@ -1625,7 +1640,7 @@ async def retrieve_data(self) -> DataFrame:
                 msg = f"User with ID {self.user_id} not found."
                 raise ValueError(msg)
             kb_user = current_user.username
-        kb_path = _get_knowledge_bases_root_path() / kb_user / self.knowledge_base
+        kb_path = self._resolve_kb_path(_get_knowledge_bases_root_path(), kb_user, self.knowledge_base)
 
         metadata = self._get_kb_metadata(kb_path)
         if not metadata: