fix(filesystem): resolve symlinked allowed directories to both forms #3254
+61
−4
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #3253
Problem
On macOS,
/tmpis a symlink to/private/tmp. When users specify/tmpas an allowed directory:/tmpto/private/tmpand stores only/private/tmpin allowedDirectories/tmp/file.txt, the initial validation check fails because/tmpdoesn't match/private/tmpSolution
Store both the original normalized path andthe resolved path in
allowedDirectories. This allows users to access files through either form:/tmp/file.txtmatches/tmpin allowedDirectories/private/tmp/file.txtmatches/private/tmpin allowedDirectoriesChanges
src/filesystem/index.ts: Modified allowed directory initialization to store both original and resolved paths when they differsrc/filesystem/__tests__/path-validation.test.ts: Added test for the symlink behaviorTests
Reproduction
Before fix:
npx -y @modelcontextprotocol/server-filesystem /tmp # Then request /tmp/test.txt -> REJECTEDAfter fix: