[MEDIUM] validateWritePath extension check is optional — agent can write executable files to workspace

[xdevrobot]

[MEDIUM] validateWritePath extension check is optional — agent can write executable files to workspace

[MEDIUM][CWE-94]

Summary

The file extension whitelist in validateWritePath is only enforced when a fileType parameter is explicitly passed. Most call sites in the codebase do not pass fileType, allowing the agent to write any file extension — including .sh, .py, .html, .js — into the workspace.

Affected Code

File: src/workspace/validator.ts:174-201

export function validateWritePath(
  inputPath: string,
  fileType?: keyof typeof ALLOWED_EXTENSIONS  // OPTIONAL parameter
): ValidatedPath {
  // ^ fileType defaults to undefined, making extension check skipped
  ...
  // Check extension if type specified (OPTIONAL - not enforced by default)
  if (fileType && ALLOWED_EXTENSIONS[fileType]) {
    const allowedExts = ALLOWED_EXTENSIONS[fileType] as readonly string[];
    if (!allowedExts.includes(validated.extension)) {
      throw new WorkspaceSecurityError(...);
    }
  }
  // If fileType is undefined, ANY extension is allowed
  return validated;
}

The fileType parameter is optional (line 176) and defaults to undefined. The comment on line 169 even confirms this: Extension whitelist is now OPTIONAL (fix from audit).

Call Sites That Skip Extension Check

File: src/webui/routes/workspace.ts:277 — WebUI write endpoint:

const validated = validateWritePath(body.path);  // No fileType!

The agent workspace write tool (src/agent/tools/workspace/write.ts) likely also calls without fileType.

Attack Scenario

1. Agent (or user via WebUI) writes a file like exploit.sh or backdoor.py to workspace
2. If exec tool has filesystem access or if auto-execution is triggered, the code runs
3. Even without exec, arbitrary file types clutter the workspace and may be executed by other tool chains

Impact

• Agent can write arbitrary executable content to workspace disk
• If the workspace directory is in PATH or auto-execution is enabled, this becomes RCE
• HTML/JS files could be served via WebUI and exploit browser vulnerabilities

Severity Assessment

MEDIUM — Requires a secondary execution path (exec tool with workspace access) to escalate to RCE, but the write path itself is unchecked.

Recommended Fix

1. Make fileType required (remove ? optional marker)
2. Add a default "text" fileType with safe extensions [.md, .txt, .json, .yaml, .csv]
3. Audit all call sites to ensure they pass appropriate fileType
4. Consider blocking executable extensions (.sh, .py, .js, .html) entirely