fix: prevent path traversal in remote file synchronization

[g0w6y]

This PR fixes a critical path traversal vulnerability in the fetchRemote method of the Files class. Previously, remote filenames containing traversal sequences (e.g., ../../) were resolved without validation, allowing files to be written outside the intended project directory.

Changes

Established a Security Boundary: Resolved the absolute path of the contentDir to serve as a "jail" for file operations.

Path Normalization: Used path.resolve to normalize remote filenames and extensions into absolute local paths.

Boundary Validation: Implemented a check to ensure that the resolvedPath starts with the absoluteContentDir followed by the platform-specific path separator.

Security Error Handling: Added logic to throw a Security Error if a file resolution attempt falls outside the project directory, halting potentially malicious write operations.

Impact This fix prevents an attacker with control over a remote Apps Script project from performing arbitrary file writes on a user's local machine during a clasp pull or clasp clone. This effectively neutralizes a potential Remote Code Execution (RCE) vector.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[g0w6y]

Any Update ?

[sqrrrl]

Appreciate the fix, just need the CLA signed

[sqrrrl]

Suggest tightening up the check. It's mostly good, just a small edge case it misses.

[g0w6y]

I have updated the implementation to include the robust security check as requested.

Changes made:

Added a dedicated isInside helper function that uses path.relative to mathematically verify directory boundaries.

Established an absoluteContentDir security "jail" within the fetchRemote method.

Implemented a check that throws a Security Error if a remote file attempts to write outside the project directory, effectively blocking path traversal and prefix-sharing attacks.

Ready for your review

[g0w6y]

Hi @sqrrrl I’ve updated the implementation to use a path.relative()-based isInside helper exactly as you suggested, which closes the prefix edge case.

All checks are now passing and the CLA is signed. Would you mind taking another look when you have a moment? Thanks!

[g0w6y]

Hi @sqrrrl,

Now that this fix is merged and released, would you like to track this via a GitHub Security Advisory (GHSA) or CVE?

The issue addressed a CWE-22 path traversal in fetchRemote that allowed untrusted remote filenames to escape the project directory and perform arbitrary file writes during clasp pull/clone, with potential for persistent local code execution.

Happy to help with a short advisory write-up if useful. Thanks!

[g0w6y]

Hi @sqrrrl any update ?