fix: reject escaping template symlinks

Author: tomdps

src/template-resolver.js

@@ -24,25 +24,39 @@ function invalidTemplateNameError(label, name) {
   );
 }
 
+function isPathContained(root, target) {
+  const relativePath = path.relative(root, target);
+  return (
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relativePath)
+  );
+}
+
 function resolveNamedTemplatePath(directory, name, label) {
   if (typeof name !== 'string' || !TEMPLATE_NAME_PATTERN.test(name)) {
     throw invalidTemplateNameError(label, name);
   }
 
   const templateRoot = path.resolve(directory);
   const templatePath = path.resolve(templateRoot, `${name}.json`);
-  const relativePath = path.relative(templateRoot, templatePath);
-  if (
-    relativePath === '..' ||
-    relativePath.startsWith(`..${path.sep}`) ||
-    path.isAbsolute(relativePath)
-  ) {
+  if (!isPathContained(templateRoot, templatePath)) {
     throw invalidTemplateNameError(label, name);
   }
 
   return templatePath;
 }
 
+function canonicalizeNamedTemplatePath(directory, templatePath, name, label) {
+  const canonicalRoot = fs.realpathSync(directory);
+  const canonicalTemplatePath = fs.realpathSync(templatePath);
+  if (!isPathContained(canonicalRoot, canonicalTemplatePath)) {
+    throw invalidTemplateNameError(label, name);
+  }
+
+  return canonicalTemplatePath;
+}
+
 function isIdentifierChar(char) {
   if (!char) return false;
   const code = char.charCodeAt(0);
@@ -137,11 +151,17 @@ class TemplateResolver {
         throw new Error(`Config not found: ${config} (looked in ${configPath})`);
       }
 
+      const canonicalConfigPath = canonicalizeNamedTemplatePath(
+        this.templatesDir,
+        configPath,
+        config,
+        'config'
+      );
       return {
         kind: 'static',
         name: config,
         params: null,
-        loadedConfig: JSON.parse(fs.readFileSync(configPath, 'utf8')),
+        loadedConfig: JSON.parse(fs.readFileSync(canonicalConfigPath, 'utf8')),
       };
     }
 
@@ -179,7 +199,13 @@ class TemplateResolver {
       throw new Error(`Base template not found: ${baseName} (looked in ${templatePath})`);
     }
 
-    const templateJson = fs.readFileSync(templatePath, 'utf8');
+    const canonicalTemplatePath = canonicalizeNamedTemplatePath(
+      this.baseTemplatesDir,
+      templatePath,
+      baseName,
+      'base template'
+    );
+    const templateJson = fs.readFileSync(canonicalTemplatePath, 'utf8');
     const template = JSON.parse(templateJson);
 
     return this.resolveTemplate(template, params);
@@ -482,7 +508,13 @@ class TemplateResolver {
     if (!fs.existsSync(templatePath)) {
       return null;
     }
-    const template = JSON.parse(fs.readFileSync(templatePath, 'utf8'));
+    const canonicalTemplatePath = canonicalizeNamedTemplatePath(
+      this.baseTemplatesDir,
+      templatePath,
+      baseName,
+      'base template'
+    );
+    const template = JSON.parse(fs.readFileSync(canonicalTemplatePath, 'utf8'));
     return {
       name: template.name,
       description: template.description,

tests/template-resolver.test.js

@@ -217,6 +217,50 @@ describe('TemplateResolver config references', function () {
     assert.strictEqual(parameterizedReference.loadedConfig.agents[0].id, 'parameterized-agent');
   });
 
+  it('should load symlinks whose canonical targets remain inside each template root', function () {
+    fs.symlinkSync(
+      path.join(templatesDir, 'safe-config_1.json'),
+      path.join(templatesDir, 'static-alias.json')
+    );
+    fs.symlinkSync(
+      path.join(templatesDir, 'base-templates', 'safe-base_template.json'),
+      path.join(templatesDir, 'base-templates', 'base-alias.json')
+    );
+
+    const staticReference = resolver.resolveConfigReference('static-alias');
+    assert.strictEqual(staticReference.loadedConfig.agents[0].id, 'static-agent');
+
+    const parameterizedReference = resolver.resolveConfigReference({
+      base: 'base-alias',
+      params: {},
+    });
+    assert.strictEqual(parameterizedReference.loadedConfig.agents[0].id, 'parameterized-agent');
+  });
+
+  it('should reject safe-named symlinks escaping each template root', function () {
+    fs.symlinkSync(
+      path.join(tempDir, 'outside-static.json'),
+      path.join(templatesDir, 'escaped-static.json')
+    );
+    fs.symlinkSync(
+      path.join(templatesDir, 'outside-base.json'),
+      path.join(templatesDir, 'base-templates', 'escaped-base.json')
+    );
+
+    assert.throws(
+      () => resolver.resolveConfigReference('escaped-static'),
+      /Invalid config name/
+    );
+    assert.throws(
+      () => resolver.resolveConfigReference({ base: 'escaped-base', params: {} }),
+      /Invalid base template name/
+    );
+    assert.throws(
+      () => resolver.getTemplateInfo('escaped-base'),
+      /Invalid base template name/
+    );
+  });
+
   it('should preserve not-found and config-shape behavior for safe names', function () {
     assert.throws(
       () => resolver.resolveConfigReference('does-not-exist'),