From f45260e29a04c217ae64cfb43a85ba013714a6de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=99=88=E5=AE=B6=E5=90=8D?= Date: Thu, 2 Jul 2026 10:37:57 +0800 Subject: [PATCH] fix: redact directory path validation errors --- .../src/crewai_tools/security/safe_path.py | 4 +++- lib/crewai-tools/tests/utilities/test_safe_path.py | 10 ++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/lib/crewai-tools/src/crewai_tools/security/safe_path.py b/lib/crewai-tools/src/crewai_tools/security/safe_path.py index 986cf799a2..e10c69fdb1 100644 --- a/lib/crewai-tools/src/crewai_tools/security/safe_path.py +++ b/lib/crewai-tools/src/crewai_tools/security/safe_path.py @@ -117,7 +117,9 @@ def validate_directory_path(path: str, base_dir: str | None = None) -> str: """ validated = validate_file_path(path, base_dir) if not os.path.isdir(validated): - raise ValueError(f"Path '{validated}' is not a directory.") + raise ValueError( + f"Path '{format_path_for_display(validated, base_dir)}' is not a directory." + ) return validated diff --git a/lib/crewai-tools/tests/utilities/test_safe_path.py b/lib/crewai-tools/tests/utilities/test_safe_path.py index 1a0faa14bf..3615410db2 100644 --- a/lib/crewai-tools/tests/utilities/test_safe_path.py +++ b/lib/crewai-tools/tests/utilities/test_safe_path.py @@ -112,6 +112,16 @@ def test_rejects_file_as_directory(self, tmp_path): with pytest.raises(ValueError, match="not a directory"): validate_directory_path("file.txt", str(tmp_path)) + def test_rejects_file_as_directory_without_leaking_base_path(self, tmp_path): + (tmp_path / "file.txt").touch() + + with pytest.raises(ValueError) as exc_info: + validate_directory_path("file.txt", str(tmp_path)) + + message = str(exc_info.value) + assert "file.txt" in message + assert str(tmp_path) not in message + def test_rejects_traversal(self, tmp_path): with pytest.raises(ValueError, match="outside the allowed directory"): validate_directory_path("../../", str(tmp_path))