fix(actors pull): block path traversal via API-supplied source file names (#1191) - #1392
Open
kuntal1461 wants to merge 1 commit into
Open
fix(actors pull): block path traversal via API-supplied source file names (#1191)#1392kuntal1461 wants to merge 1 commit into
kuntal1461 wants to merge 1 commit into
Conversation
…ames SOURCE_FILES entries from the Apify API were used directly in mkdirSync and writeFileSync without any containment check. A malicious Actor could supply names such as ../../outside.txt or an absolute path and write files outside the target Actor directory. Fix: before each filesystem operation, resolve the entry against the pull root and verify the result stays inside it using path.relative + path.isAbsolute. The isAbsolute guard also closes the Windows different-drive bypass (C:\root vs D:\outside\x.txt) where path.relative returns an absolute path that the "../" check alone would miss. Adds regression tests covering ../traversal, deep traversal, POSIX absolute paths, Windows different-drive semantics, and all legitimate nested paths. Closes apify#1191
kuntal1461
force-pushed
the
fix/actors-pull-path-traversal
branch
from
September 4, 2026 19:28
58b7841 to
df39a45
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SOURCE_FILESentries from the Apify API were used directly inmkdirSync/writeFileSyncwith no containment check, allowing a malicious Actor to write files outside the target pull directory via names like../../outside.txtor/absolute/path.file.namewithpath.relative+path.isAbsolutebefore any filesystem operation. TheisAbsoluteguard also closes the Windows different-drive bypass (C:\rootvsD:\outside\x.txt) wherepath.relativereturns an absolute path that a../prefix check alone misses.TARBALL,GITHUB_GIST,GIT_REPO) are untouched.Changes
src/commands/actors/pull.tstest/local/commands/pull-path-traversal.test.tsTest plan
pnpm vitest run test/local/commands/pull-path-traversal.test.ts— 11/11 passpnpm run lint— cleanpnpm run format— cleanpnpm run build— cleanpnpm run test:local— pre-existing Python env failures only, unrelated to this changeCloses #1191