Clarify path validation logic in safeWorkspaceResolve

[Copilot]

Addressed review feedback questioning the necessity of path validation when absPath is already absolute.

Context

The safeWorkspaceResolve function validates that resolved paths remain within /workspace. Reviewer questioned why validation is needed for absolute paths.

Clarification Provided

No code changes required. The validation serves two security purposes:

1. Absolute path injection prevention: User input like /etc/passwd resolves to an absolute path outside /workspace
2. Symlink escape prevention: fs.realpathSync() resolves symlink targets which may point outside the workspace

The check !realPath.startsWith(workspaceRoot + path.sep) validates the final resolved path after both absolute path resolution and symlink dereferencing.

function safeWorkspaceResolve(uri: string): string {
  const absPath = path.isAbsolute(uri)
    ? path.resolve(uri)           // Could be /etc/passwd
    : path.resolve(workspaceRoot, uri);

  const realPath = fs.existsSync(absPath) 
    ? fs.realpathSync(absPath)    // Could resolve to outside workspace
    : absPath;

  // Validates final path is within workspace
  if (!realPath.startsWith(workspaceRoot + path.sep)) {
    throw new Error("Cannot access path outside of workspace path.");
  }

  return realPath;
}

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d2c29c0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
web-editor	Ready	Preview	Comment	Oct 31, 2025 4:54am