The readMarkdownResource function accepted unvalidated URI pathnames, enabling path traversal attacks to read arbitrary files outside the resources directory (e.g., file://rsdoctor/../../etc/passwd).

Changes

Security validation in packages/ai/src/server/resource.ts

• Extract filename using path.basename() to strip directory components
• Reject paths containing .. sequences
• Verify resolved path remains within resources directory using path.relative() and checking for upward traversal or absolute paths

Before:

const contents = await readFileAsync(
  path.join(__dirname, './resources', uri.pathname),
  'utf-8',
);

After:

const filename = path.basename(uri.pathname);
if (!filename || filename !== uri.pathname.replace(/^\//, '') || /\.\./.test(uri.pathname)) {
  throw new Error('Invalid resource path: path traversal detected');
}

const resourcesDir = path.join(__dirname, './resources');
const filePath = path.join(resourcesDir, filename);
const relativePath = path.relative(path.resolve(resourcesDir), path.resolve(filePath));

if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
  throw new Error('Invalid resource path: access denied');
}

Test coverage

Added packages/ai/tests/resource.test.ts covering legitimate access and blocking path traversal attempts via ../, subdirectories, and absolute paths.

This pull request was created from Copilot chat.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.