🛡️ Sentinel: [HIGH] Fix Path Traversal via StartsWith Bypass

[mleem97]

🚨 Severity: HIGH
💡 Vulnerability: Path traversal bypass via StartsWith prefix matching in GregIoLuaModule.cs (ResolveSafe method).
🎯 Impact: Allows arbitrary file read/write access to files/directories that share the same prefix as the data directory (e.g., escaping Mods/mod/data to read Mods/mod/data_secret).
🔧 Fix: Added a trailing directory separator before the StartsWith check and permitted exact matches to the base directory.
✅ Verification: Compiled successfully and tests passed.

---

PR created automatically by Jules for task 10398869862784589761 started by @mleem97

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR implements a critical security fix to prevent path traversal via a StartsWith bypass, specifically targeting cases where sibling directories share a name prefix. While the fix addresses the logic gap by ensuring trailing separators are handled correctly, there is a significant risk due to the lack of automated tests.

Codacy reporting indicates the PR is 'up to standards', but coverage is marked as missing. For a high-severity vulnerability fix, the absence of regression tests is a blocker. There is also a discrepancy between the PR description (stating tests passed) and the actual file changes, which include no test code.

About this PR

• Critical concern: No unit tests were provided for this high-severity security fix. While the PR description claims tests passed, no test files or cases were added or updated. Verification is required to ensure the sandbox logic holds across platform-specific path variations and prevents regression of the 'StartsWith' bypass.

Test suggestions

• Attempting to access a sibling directory that shares a name prefix with the sandbox (e.g., 'data_backup' when 'data' is the sandbox)
• Accessing a file located directly within the sandbox directory
• Accessing the sandbox directory path itself with no relative sub-path
• Accessing a path containing directory traversal sequences (e.g., '../../')
• Null or empty path inputs

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Attempting to access a sibling directory that shares a name prefix with the sandbox (e.g., 'data_backup' when 'data' is the sandbox)
2. Accessing a file located directly within the sandbox directory
3. Accessing the sandbox directory path itself with no relative sub-path
4. Accessing a path containing directory traversal sequences (e.g., '../../')
5. Null or empty path inputs

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Suggestion: The implementation correctly ensures the validated path is either the sandbox root or a direct child by checking for the directory separator. However, this logic is essential for the sandbox security model and currently lacks unit tests. It is recommended to add a suite of tests for the ResolveSafe method covering valid paths, traversal attempts (../../), prefix bypass (e.g., /app vs /app_data), and null/empty inputs.