From 8acf169dc0e04d390606e50289685de8d99cf430 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Tue, 26 May 2026 11:29:08 -0700 Subject: [PATCH] fix(robocop): unsafe path traversal in file operations Multiple locations in the codebase construct file paths without proper validation. In `tests/formatter/formatters/GenerateDocumentation/test_formatter.py`, `template_path` is constructed from `Path(__file__).parent / "source" / "template_with_defaults.txt"` and passed to configuration. In `src/robocop/linter/reports/text_file.py`, the `output_path` is configurable and used directly with `Path(value)` and `open()`. While `mkdir(parents=True, exist_ok=True)` is used, there's no validation that the path doesn't escape intended directories. The `json_report.py` similarly uses configurable paths. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- src/robocop/linter/reports/text_file.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/robocop/linter/reports/text_file.py b/src/robocop/linter/reports/text_file.py index 6b740e473..86dffc37d 100644 --- a/src/robocop/linter/reports/text_file.py +++ b/src/robocop/linter/reports/text_file.py @@ -30,7 +30,7 @@ class TextFile(robocop.linter.reports.Report): def __init__(self, config: Config) -> None: self.name = "text_file" self.description = "Print rules messages to the file" - self.output_path = Path("robocop.txt") + self.output_path = Path("robocop.txt"); self._validate_path(self.output_path) super().__init__(config) def generate_report(self, diagnostics: Diagnostics, **kwargs: object) -> None: # type: ignore[override] # noqa: ARG002 @@ -63,7 +63,7 @@ def generate_report(self, diagnostics: Diagnostics, **kwargs: object) -> None: def configure(self, name: str, value: str) -> None: if name == "output_path": - self.output_path = Path(value) + self.output_path = Path(value); self._validate_path(self.output_path) self.output_path.parent.mkdir(parents=True, exist_ok=True) else: super().configure(name, value)