mirror of
https://github.com/AutoMaker-Org/automaker.git
synced 2026-01-30 06:12:03 +00:00
8ff4b5912a
This commit consolidates directory security from two environment variables (WORKSPACE_DIR, ALLOWED_PROJECT_DIRS) into a single ALLOWED_ROOT_DIRECTORY variable while maintaining backward compatibility. Changes: - Re-enabled path validation in security.ts (was previously disabled) - Implemented isPathAllowed() to check ALLOWED_ROOT_DIRECTORY with DATA_DIR exception - Added backward compatibility for legacy ALLOWED_PROJECT_DIRS and WORKSPACE_DIR - Implemented path traversal protection via isPathWithinDirectory() helper - Added PathNotAllowedError custom exception for security violations - Updated all FS route endpoints to validate paths and return 403 on violation - Updated template clone endpoint to validate project paths - Updated workspace config endpoints to use ALLOWED_ROOT_DIRECTORY - Fixed stat() response property access bug in project-init.ts - Updated security tests to expect actual validation behavior Security improvements: - Path validation now enforced at all layers (routes, project init, agent services) - appData directory (DATA_DIR) always allowed for settings/credentials - Backward compatible with existing ALLOWED_PROJECT_DIRS/WORKSPACE_DIR configurations - Protection against path traversal attacks Backend test results: 654/654 passing ✅ 🤖 Generated with Claude Code Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
15 lines
600 B
Plaintext
15 lines
600 B
Plaintext
services:
|
|
server:
|
|
volumes:
|
|
# Mount your workspace directory to /projects inside the container
|
|
# Example: mount your local /workspace to /projects inside the container
|
|
- /Users/webdevcody/Workspace/automaker-workspace:/projects:rw
|
|
environment:
|
|
# Set root directory for all projects and file operations
|
|
# Users can only create/open projects within this directory
|
|
- ALLOWED_ROOT_DIRECTORY=/projects
|
|
|
|
# Optional: Set workspace directory for UI project discovery
|
|
# Falls back to ALLOWED_ROOT_DIRECTORY if not set
|
|
# - WORKSPACE_DIR=/projects
|