Summary
derive_repo_base_name strips a trailing .git suffix from a target URL/path and passes the result through sanitize_name, which only strips characters outside [A-Za-z0-9._-] — dots are preserved. A target string ending in ..git therefore derives a base name of literally .. (parent-directory reference).
Impact
The derived base name is used to build clone_path = temp_dir / dest_name, and the destination is rmtree'd before cloning. A crafted target string ending in ..git can make Strix delete a directory outside the intended per-scan temp folder — e.g. a sibling directory of temp_dir — rather than the scoped clone destination.
Where
strix/interface/utils.py:
sanitize_name (regex [^A-Za-z0-9._-] → -) preserves dots, so .. survives.derive_repo_base_name strips .git suffix then calls sanitize_name, producing .. for a ..git-suffixed input.- The resulting
dest_name is joined under temp_dir and rmtree'd before clone.
Suggested fix
- After deriving the base name, explicitly reject (or normalize away)
./.. and any name that isn't a plain relative path component — e.g. if dest_name in {"", ".", ".."} or "/" in dest_name or "\\" in dest_name: raise.
- Alternatively, resolve
clone_path and assert it is still a direct child of temp_dir (clone_path.resolve().parent == temp_dir.resolve()) before doing anything destructive like rmtree.
Flagging alongside the other two findings from the same pass over strix/interface/utils.py.
Summary
derive_repo_base_namestrips a trailing.gitsuffix from a target URL/path and passes the result throughsanitize_name, which only strips characters outside[A-Za-z0-9._-]— dots are preserved. A target string ending in..gittherefore derives a base name of literally..(parent-directory reference).Impact
The derived base name is used to build
clone_path = temp_dir / dest_name, and the destination isrmtree'd before cloning. A crafted target string ending in..gitcan make Strix delete a directory outside the intended per-scan temp folder — e.g. a sibling directory oftemp_dir— rather than the scoped clone destination.Where
strix/interface/utils.py:sanitize_name(regex[^A-Za-z0-9._-]→-) preserves dots, so..survives.derive_repo_base_namestrips.gitsuffix then callssanitize_name, producing..for a..git-suffixed input.dest_nameis joined undertemp_dirandrmtree'd before clone.Suggested fix
./..and any name that isn't a plain relative path component — e.g.if dest_name in {"", ".", ".."} or "/" in dest_name or "\\" in dest_name: raise.clone_pathand assert it is still a direct child oftemp_dir(clone_path.resolve().parent == temp_dir.resolve()) before doing anything destructive likermtree.Flagging alongside the other two findings from the same pass over
strix/interface/utils.py.