🛡️ Sentinel: [HIGH] Fix path traversal in Lua IO module

[mleem97]

Severity: HIGH
Vulnerability: The ResolveSafe method in GregIoLuaModule used a prefix-matching StartsWith check without appending a trailing directory separator. This allowed a path traversal bypass where an attacker could access a directory that shared the same prefix as the intended data directory (e.g., escaping .../data to access .../data_secret).
Impact: An attacker or malicious Lua mod could read, write, or delete arbitrary files outside the intended sandbox directory, provided the target directory shared the sandbox's prefix. This could lead to information disclosure or unauthorized modifications.
Fix: Updated the sandbox boundary check to append a trailing directory separator to the base path before performing the StartsWith check, and added an exact match check for the base directory itself.
Verification: Ran the test suite (dotnet test tests/gregCore.Tests.csproj) to ensure compilation and existing tests pass. Manually verified the C# behavior in a test script.

---

PR created automatically by Jules for task 16670606122966175377 started by @mleem97

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

This PR addresses a high-severity path traversal vulnerability by refining the Lua IO module's boundary checks. The implementation correctly prevents sandbox escapes via directory prefix matching (e.g., 'data_secret' vs 'data/').

However, there are two primary concerns: first, the fix lacks automated unit tests, which is critical for preventing regressions of security vulnerabilities. Second, the current path comparison uses case-insensitive logic, which may allow sandbox escapes on case-sensitive filesystems (Linux/macOS) if an attacker can target directories that differ only by case. Despite Codacy indicating the PR is up to standards, these points should be addressed before merging.

About this PR

• No automated unit tests were included in this PR to verify the path traversal fix. Given this is a high-severity security vulnerability, it is essential to include regression tests that exercise the boundary conditions (exact match, subpath, prefix escape, and standard traversal) to ensure the sandbox remains secure in the future.

Test suggestions

• Verify that a path matching the base directory exactly (e.g., '.') is permitted.
• Verify that a path inside the data directory (e.g., 'sub/file.txt') is permitted.
• Verify that a path sharing the base directory prefix but outside the sandbox (e.g., 'data_secret') is blocked.
• Verify that standard path traversal sequences (e.g., '../../etc/passwd') are blocked.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that a path matching the base directory exactly (e.g., '.') is permitted.
2. Verify that a path inside the data directory (e.g., 'sub/file.txt') is permitted.
3. Verify that a path sharing the base directory prefix but outside the sandbox (e.g., 'data_secret') is blocked.
4. Verify that standard path traversal sequences (e.g., '../../etc/passwd') are blocked.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Suggestion: This implementation correctly prevents partial path traversal (CWE-22) by ensuring the base directory comparison includes a directory separator. However, using StringComparison.OrdinalIgnoreCase for path validation can lead to sandbox bypasses on case-sensitive filesystems (Linux/macOS) where directories like '/data' and '/DATA' are distinct.

Refactor the ResolveSafe method to use platform-appropriate comparison (e.g., Ordinal on Unix-like systems) and consider simplifying the trailing separator logic using a ternary operator for conciseness.