langchain-ai/deepagents
1
0
Fork 0
mirror of https://github.com/langchain-ai/deepagents.git synced 2026-07-21 09:15:22 -04:00
Code Issues 169 Packages Projects Releases 16 Wiki Activity

[PR #1319] fix: Missing _validate_path() on Grep Tool's path Parameter Allows Directory Traversal #1303

New Issue
Open
opened 2026-02-16 09:18:40 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 09:18:40 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/deepagents/pull/1319
Author: @corridor-security[bot]
Created: 2/12/2026
Status: 🔄 Open

Base: main ← Head: corridor/fix-77962820-1770934197774

📝 Commits (1)

  • 7b5bb6b Update libs/deepagents/deepagents/middleware/filesystem.py

📊 Changes

1 file changed (+10 additions, -0 deletions)

View changed files

📝 libs/deepagents/deepagents/middleware/filesystem.py (+10 -0)

📄 Description

Summary

This PR was generated by Corridor to fix:

  • Missing _validate_path() on Grep Tool's path Parameter Allows Directory Traversal

Changes

The patch adds a conditional path validation for both sync_grep and async_grep by invoking _validate_path() when a non-None path is provided, wrapping it in a try/except ValueError to return a user-friendly error message in line with other tools. When path is None, validation is skipped to preserve the current working directory behavior. This minimal change aligns the grep tool with other filesystem tools, closing the path traversal vulnerability without altering additional behavior.

Generated by Corridor

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/deepagents/pull/1319 **Author:** [@corridor-security[bot]](https://github.com/apps/corridor-security) **Created:** 2/12/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `corridor/fix-77962820-1770934197774` --- ### 📝 Commits (1) - [`7b5bb6b`](https://github.com/langchain-ai/deepagents/commit/7b5bb6bda432a42c462e1792aa5939ecabdcac3d) Update libs/deepagents/deepagents/middleware/filesystem.py ### 📊 Changes **1 file changed** (+10 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `libs/deepagents/deepagents/middleware/filesystem.py` (+10 -0) </details> ### 📄 Description ## Summary This PR was generated by [Corridor](https://corridor.dev) to fix: - Missing _validate_path() on Grep Tool's path Parameter Allows Directory Traversal ## Changes The patch adds a conditional path validation for both sync_grep and async_grep by invoking _validate_path() when a non-None path is provided, wrapping it in a try/except ValueError to return a user-friendly error message in line with other tools. When path is None, validation is skipped to preserve the current working directory behavior. This minimal change aligns the grep tool with other filesystem tools, closing the path traversal vulnerability without altering additional behavior. --- Generated by Corridor --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-16 09:18:40 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
MCP
backends
bug
cli
config
customization
deepagents
documentation
external
feature
fix
good first issue
help wanted
integration
internal
invalid
middleware
model
needs investigation
p0
p1
p2
p3
performance
pull-request
Mirrored from GitHub Pull Request
 question
sdk
subagents
unable to reproduce
windows
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/deepagents#1303
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?