claude-code - 💡(How to fix) Fix [Bug] Unsafe directory traversal attempt during /init - attempted parent directory access [4 comments, 2 participants]

TL;DR

The issue may be resolved by properly handling directory traversal attempts in the /init endpoint.

Guidance

• Review the /init endpoint code to ensure it correctly handles directory traversal attempts, such as ../ or absolute paths.
• Consider implementing input validation and sanitization to prevent unauthorized access to parent directories.
• Verify that the Bash(ls -la "D:/code-projects") command is necessary and cannot be replaced with a safer alternative.
• Investigate if there are any existing security measures or configurations in the windows-terminal or win32 platform that can help mitigate this issue.

Notes

The provided error log is empty, which may indicate that the issue is not directly related to an error, but rather a security concern or unexpected behavior.

Recommendation

Apply workaround: Implement input validation and sanitization to prevent unauthorized access to parent directories, as upgrading to a fixed version is not clearly implied in the issue.