From 0838a2a7c41498f1c9e1888e2adb8a42b46ad463 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Thu, 26 Mar 2026 11:31:48 -0700
Subject: [PATCH] fix(mcp): validate file path in browser_set_storage_state
 tool

---
 packages/playwright-core/src/tools/backend/storage.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/playwright-core/src/tools/backend/storage.ts b/packages/playwright-core/src/tools/backend/storage.ts
index 152ba453b17a7..e416f84b3b079 100644
--- a/packages/playwright-core/src/tools/backend/storage.ts
+++ b/packages/playwright-core/src/tools/backend/storage.ts
@@ -55,7 +55,8 @@ const setStorageState = defineTool({
 
   handle: async (context, params, response) => {
     const browserContext = await context.ensureBrowserContext();
-    await browserContext.setStorageState(params.filename);
+    const resolvedFilename = await response.resolveClientFilename(params.filename);
+    await browserContext.setStorageState(resolvedFilename);
     response.addTextResult(`Storage state restored from ${params.filename}`);
     response.addCode(`await page.context().setStorageState('${params.filename}');`);
   },