Skip to content

[Aikido] AI Fix for Path traversal attack possible #138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aikido-autofix wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −1
Open

[Aikido] AI Fix for Path traversal attack possible #138

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion crates/tracevault-server/src/api/code.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,8 +277,13 @@ pub async fn get_tree(
let target_tree = if query.path.is_empty() || query.path == "/" {
tree
} else {
// Prevent path traversal attacks by rejecting paths containing '..'.
Copy link
Copy Markdown

@aikido-pr-checks aikido-pr-checks Bot May 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Multiple endpoints now contain duplicated inline path traversal checks; extract a common helper to reduce duplication and improve maintainability.

Details

✨ AI Reasoning
​The PR adds repeated logic that validates paths by constructing std::path::Path and checking for ParentDir components in multiple request handlers. Each added block performs the same responsibility (path traversal validation) inline inside distinct endpoint functions. This increases code duplication and the file's complexity, making behavior harder to update or audit. A small, focused helper would centralize validation and reduce repetition, improving maintainability without a large refactor.

🔧 How do I fix it?
Split large files into smaller, focused modules. Each file should have a single responsibility.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

let path = std::path::Path::new(&query.path);
if path.components().any(|c| c == std::path::Component::ParentDir) {
return Err(AppError::BadRequest(format!("Invalid input: {}", path.display())));
}
let entry = tree
.get_path(std::path::Path::new(&query.path))
.get_path(path)
.map_err(|e| AppError::NotFound(format!("Path not found: {e}")))?;
let obj = entry.to_object(&repo)?;
obj.into_tree()
Expand Down
Loading