Dashboard creation handler anchors filesystem paths on a client-supplied projectPath #441

New issue

Open

opened 2026-08-23 19:29:27 +00:00 by mph · 1 comment

mph commented

2026-08-23 19:29:27 +00:00

Owner

Security finding. Raised by the security review of IW-423 Phase 2. The behaviour predates that phase, which only changed the callee of one of the three operations sharing the anchor.

The hole

dashboard/jvm/src/CaskServer.scala:1219-1220 takes projectPath from the request form. :1250-1281 then uses it as the anchor for

projectPathResolved / os.up / os.RelPath(workPath.stripPrefix("../"))

in three operations: the worktree creation, the workspace creation, and the registration.

It is not checked against the server's registered project set. The only gate is that a readable .iw/config.conf must exist at the supplied path (:1223-1233) — that proves the path looks like a project, not that it is one of ours.

Lesson: a path taken from a request and used as a filesystem anchor needs an allow-list check against known projects, not only proof that it looks like a project.

Fix

Validate the creation handler's projectPath against the server's registered projects before it is used as an anchor. The server already holds that set.

Worth reviewing whether any other dashboard handler takes a path from a request and uses it the same way.

Recorded during IW-423; see project-management/issues/IW-423/LESSONS.md entry 19.

**Security finding.** Raised by the security review of IW-423 Phase 2. The behaviour predates that phase, which only changed the callee of one of the three operations sharing the anchor. ## The hole `dashboard/jvm/src/CaskServer.scala:1219-1220` takes `projectPath` from the request form. `:1250-1281` then uses it as the anchor for ```scala projectPathResolved / os.up / os.RelPath(workPath.stripPrefix("../")) ``` in three operations: the worktree creation, the workspace creation, and the registration. It is **not** checked against the server's registered project set. The only gate is that a readable `.iw/config.conf` must exist at the supplied path (`:1223-1233`) — that proves the path looks like a project, not that it is one of ours. **Lesson:** a path taken from a request and used as a filesystem anchor needs an allow-list check against known projects, not only proof that it looks like a project. ## Fix Validate the creation handler's `projectPath` against the server's registered projects before it is used as an anchor. The server already holds that set. Worth reviewing whether any other dashboard handler takes a path from a request and uses it the same way. --- Recorded during IW-423; see `project-management/issues/IW-423/LESSONS.md` entry 19.

mph referenced this issue from a commit

2026-08-23 20:00:59 +00:00

workflow: Triage lessons for IW-423

mph referenced this issue

2026-08-23 20:01:36 +00:00

IW-423: Configured terminal workspace manager for the dashboard #444

claude commented

2026-10-16 02:53:24 +00:00

Member

Intake: needs-human
Workflow: diagnostic
Reason: G3 the Reproduction sections show no command that was run and no output; the analysis says the reproductions were traced from code only ("I did not run it for this analysis")
Analysis: project-management/issues/IW-441/analysis.md on branch IW-441

Intake: needs-human Workflow: diagnostic Reason: G3 the Reproduction sections show no command that was run and no output; the analysis says the reproductions were traced from code only ("I did not run it for this analysis") Analysis: project-management/issues/IW-441/analysis.md on branch IW-441

claude added the

needs-human

label

2026-10-16 02:53:24 +00:00