fix(agent-context): harden context file validation

Author: AustinZ21

extensions/agent-context/scripts/bash/update-agent-context.sh

@@ -150,6 +150,21 @@ for CONTEXT_FILE in "${CONTEXT_FILES[@]}"; do
       exit 1
     fi
   done
+  if ! "$_python" - "$PROJECT_ROOT" "$CONTEXT_FILE" <<'PY'
+import sys
+from pathlib import Path
+
+root = Path(sys.argv[1]).resolve()
+target = (root / sys.argv[2]).resolve(strict=False)
+try:
+    target.relative_to(root)
+except ValueError:
+    sys.exit(1)
+PY
+  then
+    echo "agent-context: context file path resolves outside the project root; got '$CONTEXT_FILE'." >&2
+    exit 1
+  fi
 done
 unset _cf_parts _seg
 

extensions/agent-context/scripts/powershell/update-agent-context.ps1

@@ -52,6 +52,66 @@ function Test-ConfigObject {
     return $false
 }
 
+function Resolve-ContextPath {
+    param(
+        [Parameter(Mandatory = $true)][string]$Root,
+        [Parameter(Mandatory = $true)][string]$RelativePath
+    )
+
+    $rootFull = [System.IO.Path]::GetFullPath($Root)
+    $segments = $RelativePath -split '/'
+    $resolved = $rootFull
+
+    foreach ($segment in $segments) {
+        if ([string]::IsNullOrWhiteSpace($segment) -or $segment -eq '.') {
+            continue
+        }
+
+        $candidate = [System.IO.Path]::GetFullPath((Join-Path $resolved $segment))
+        if (Test-Path -LiteralPath $candidate) {
+            $item = Get-Item -LiteralPath $candidate -Force
+            if ($item.Attributes -band [System.IO.FileAttributes]::ReparsePoint) {
+                $target = $item.Target
+                if ($target -is [System.Array]) {
+                    $target = $target[0]
+                }
+                if ($target) {
+                    if ([System.IO.Path]::IsPathRooted($target)) {
+                        $candidate = [System.IO.Path]::GetFullPath($target)
+                    } else {
+                        $candidate = [System.IO.Path]::GetFullPath(
+                            (Join-Path (Split-Path -Parent $candidate) $target)
+                        )
+                    }
+                }
+            }
+        }
+        $resolved = $candidate
+    }
+
+    return $resolved
+}
+
+function Test-IsSubPath {
+    param(
+        [Parameter(Mandatory = $true)][string]$Root,
+        [Parameter(Mandatory = $true)][string]$Path
+    )
+
+    $comparison = if ([System.Environment]::OSVersion.Platform -eq [System.PlatformID]::Win32NT) {
+        [System.StringComparison]::OrdinalIgnoreCase
+    } else {
+        [System.StringComparison]::Ordinal
+    }
+    $rootFull = [System.IO.Path]::GetFullPath($Root).TrimEnd(
+        [System.IO.Path]::DirectorySeparatorChar,
+        [System.IO.Path]::AltDirectorySeparatorChar
+    )
+    $pathFull = [System.IO.Path]::GetFullPath($Path)
+    return $pathFull.Equals($rootFull, $comparison) -or
+        $pathFull.StartsWith($rootFull + [System.IO.Path]::DirectorySeparatorChar, $comparison)
+}
+
 $ErrorActionPreference = 'Stop'
 $DefaultStart = '<!-- SPECKIT START -->'
 $DefaultEnd   = '<!-- SPECKIT END -->'
@@ -143,8 +203,8 @@ if (-not (Test-ConfigObject -Object $Options)) {
 
 $ConfiguredContextFiles = Get-ConfigValue -Object $Options -Key 'context_files'
 $ContextFiles = @()
-if ($ConfiguredContextFiles -is [System.Array]) {
-    foreach ($item in $ConfiguredContextFiles) {
+if ($null -ne $ConfiguredContextFiles) {
+    foreach ($item in @($ConfiguredContextFiles)) {
         if ($item -is [string] -and -not [string]::IsNullOrWhiteSpace($item)) {
             $ContextFiles += $item.Trim()
         }
@@ -163,16 +223,25 @@ if ($ContextFiles.Count -eq 0) {
 }
 
 foreach ($ContextFile in $ContextFiles) {
-    # Reject absolute paths and '..' path segments in context files
+    # Reject absolute paths, backslash separators, and '..' path segments in context files
     if ([System.IO.Path]::IsPathRooted($ContextFile)) {
         Write-Warning "agent-context: context files must be project-relative paths; got '$ContextFile'."
         exit 1
     }
+    if ($ContextFile.Contains('\')) {
+        Write-Warning "agent-context: context files must not contain backslash separators; got '$ContextFile'."
+        exit 1
+    }
     $cfSegments = $ContextFile -split '[/\\]'
     if ($cfSegments -contains '..') {
         Write-Warning "agent-context: context files must not contain '..' path segments; got '$ContextFile'."
         exit 1
     }
+    $resolvedTarget = Resolve-ContextPath -Root $ProjectRoot -RelativePath $ContextFile
+    if (-not (Test-IsSubPath -Root $ProjectRoot -Path $resolvedTarget)) {
+        Write-Warning "agent-context: context file path resolves outside the project root; got '$ContextFile'."
+        exit 1
+    }
 }
 
 $MarkerStart = $DefaultStart

src/specify_cli/agents.py

@@ -412,14 +412,29 @@ def resolve_skill_placeholders(
             ac_cfg = _load_agent_context_config(project_root)
             context_files = ac_cfg.get("context_files")
             if isinstance(context_files, list):
-                context_file_values = [
-                    value.strip()
-                    for value in context_files
-                    if isinstance(value, str) and value.strip()
-                ]
+                context_file_values = []
+                seen: set[str] = set()
+                for value in context_files:
+                    if not isinstance(value, str):
+                        continue
+                    candidate = value.strip()
+                    if not candidate or candidate in seen:
+                        continue
+                    context_file_values.append(
+                        IntegrationBase._validate_context_file_path(
+                            project_root, candidate
+                        )
+                    )
+                    seen.add(candidate)
                 context_file = ", ".join(dict.fromkeys(context_file_values))
             if not context_file:
-                context_file = ac_cfg.get("context_file") or ""
+                configured_context_file = ac_cfg.get("context_file")
+                if isinstance(configured_context_file, str):
+                    candidate = configured_context_file.strip()
+                    if candidate:
+                        context_file = IntegrationBase._validate_context_file_path(
+                            project_root, candidate
+                        )
         if not context_file:
             context_file = init_opts.get("context_file") or ""
         body = body.replace("__CONTEXT_FILE__", context_file)

src/specify_cli/integrations/base.py

@@ -759,7 +759,7 @@ def _resolve_context_files(self, project_root: Path) -> list[str]:
     def _context_file_display(self, project_root: Path) -> str:
         """Return human-readable context file target(s) for templates."""
         if not self._agent_context_extension_enabled(project_root):
-            return self.context_file
+            return self.context_file or ""
         return ", ".join(self._resolve_context_files(project_root))
 
     @staticmethod