From 5f2d3e6812f01fe6194bcfd976970a6e3c4186cc Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Mon, 30 Mar 2026 08:18:08 +0000 Subject: [PATCH] fix: add path traversal check in service_logs get_log_file endpoint (#8605) Co-authored-by: Claude Opus 4.6 (1M context) --- backend/windmill-api/src/service_logs.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/backend/windmill-api/src/service_logs.rs b/backend/windmill-api/src/service_logs.rs index 2e03a5a104..57131d823e 100644 --- a/backend/windmill-api/src/service_logs.rs +++ b/backend/windmill-api/src/service_logs.rs @@ -97,6 +97,9 @@ async fn get_log_file( require_devops_role(&db, &email).await?; let path = path.to_path(); + if path.contains("..") { + return Err(Error::BadRequest("Invalid path".to_string())); + } #[cfg(feature = "parquet")] let s3_client = windmill_object_store::get_object_store().await; #[cfg(feature = "parquet")]