🛡️ Sentinel: [CRITICAL] 파일 다운로드/내보내기 시 경로 순회 취약점 수정

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2026-06-13 - Fix path traversal in exportGherkin
+**Vulnerability:** The `exportGherkin` function allows writing the exported feature file to any path on the system via the `output` argument, because it does not validate that the resolved path is within the project directory.
+**Learning:** `path.join(root, output)` does not prevent path traversal if `output` starts with `../` or is an absolute path.
+**Prevention:** Construct absolute paths using `path.resolve()` and verify boundaries using `const rel = path.relative(root, target)`. Always check both `rel.startsWith("..")` and `path.isAbsolute(rel)` to ensure security.

src/export/gherkin.ts

@@ -1,7 +1,8 @@
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { findUseCaseFile, readConfig, relativePath } from "../files.js";
 import { parseUseCaseMarkdown } from "../format/parse.js";
+import { VspecError } from "../errors.js";
 import type { ParsedUseCase } from "../domain/types.js";
 
 export function renderGherkin(useCase: ParsedUseCase): string {
@@ -39,7 +40,11 @@ export function exportGherkin(args: { key: string; output?: string; cwd?: string
   if (!source) throw new Error("KEY_NOT_FOUND");
   const text = renderGherkin(parseUseCaseMarkdown(readFileSync(source, "utf8")));
   const output = args.output ?? join("tests", `${args.key}.feature`);
-  const outputPath = join(config.root, output);
+  const outputPath = resolve(config.root, output);
+  const rel = relative(config.root, outputPath);
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    throw new VspecError("INVALID_ARGUMENT", "Output path must be within the project root.");
+  }
   mkdirSync(dirname(outputPath), { recursive: true });
   writeFileSync(outputPath, text);
   return { key: args.key, text, path: relativePath(outputPath, config.root) };

tests/gherkin.test.ts

@@ -1,8 +1,13 @@
 import { readFileSync } from "node:fs";
+import { mkdirSync, rmSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { join } from "node:path";
-import { describe, expect, it } from "vitest";
-import { renderGherkin } from "../src/export/gherkin.js";
+import { tmpdir } from "node:os";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { exportGherkin, renderGherkin } from "../src/export/gherkin.js";
 import { parseUseCaseMarkdown } from "../src/format/parse.js";
+import { initProject } from "../src/project.js";
+import { createUseCase } from "../src/usecase-commands.js";
 
 describe("gherkin export", () => {
   it("renders the golden feature byte-for-byte", () => {
@@ -11,3 +16,24 @@ describe("gherkin export", () => {
     expect(renderGherkin(useCase)).toBe(expected);
   });
 });
+
+describe("exportGherkin security", () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = join(tmpdir(), `vspec-gherkin-${randomUUID()}`);
+    mkdirSync(root, { recursive: true });
+    initProject({ root });
+  });
+
+  afterEach(() => {
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  it("prevents path traversal outside the project directory", () => {
+    const { key } = createUseCase({ title: "Test Traversal", primaryActor: "user", cwd: root });
+    expect(() => {
+      exportGherkin({ key, output: "../../../../tmp/pwned.feature", cwd: root });
+    }).toThrow(/Output path must be within the project root/);
+  });
+});