Confine /local_repo/structure to allowed local roots (fixes #587) - #588
Open
carfeii wants to merge 1 commit into
Open
Confine /local_repo/structure to allowed local roots (fixes #587)#588carfeii wants to merge 1 commit into
carfeii wants to merge 1 commit into
Conversation
GET /local_repo/structure accepted an arbitrary caller-supplied path with no authentication and no confinement, os.walk-ing it and returning the full recursive file tree plus any README.md content. On the by-default-unauthenticated API a remote client could enumerate the server's filesystem (path=/ etc.) and read README files anywhere. Restrict the path to an allowlist of base roots (default the deepwiki data root, extensible via DEEPWIKI_ALLOWED_LOCAL_ROOTS) and return 403 for anything resolving outside it. Cloned repos live under the data root so the normal flow is unaffected; the local-repository RAG intake should get the same confinement.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #587.
Problem
GET /local_repo/structure?path=<path>(api/routers/wiki.py)os.walks a caller-supplied path with no authentication and no confinement, returning the full recursive file tree plus anyREADME.mdcontent. The API is unauthenticated by default (DEEPWIKI_AUTH_MODE=False), so a remote client can enumerate the server's filesystem (?path=/,/home,/etc, ...) and read README files anywhere.Change
_allowed_local_roots()(defaultdeepwiki_root(), extensible viaDEEPWIKI_ALLOWED_LOCAL_ROOTS,os.pathsep-separated) and_resolve_allowed_local_path(), which resolves the path withos.path.realpathand only returns it when it stays within an allowed root (blocks absolute paths outside the allowlist and../symlink traversal).get_local_repo_structurenow resolves the request path through it and returns403when it is outside the allowlist.Cloned repositories live under
deepwiki_root(), so the normal flow is unaffected; operators analyzing local repositories elsewhere setDEEPWIKI_ALLOWED_LOCAL_ROOTS.The same helper should also gate the local-repository RAG intake (
read_all_documentsvia a localrepo_url); kept out of this PR to stay minimal and focused on the directly-exploitable unauthenticated endpoint.