fix: restrict execute_code filenames to work_dir

packages/dbgpt-core/src/dbgpt/util/code_utils.py

@@ -153,6 +153,20 @@ def _cmd(lang):
     raise NotImplementedError(f"{lang} not recognized in code execution")
 
 
+def _resolve_work_dir_filepath(work_dir: str, filename: str) -> str:
+    work_dir_path = pathlib.Path(work_dir).resolve()
+    filename_path = pathlib.Path(filename)
+    if filename_path.is_absolute():
+        raise ValueError("filename must be a relative path inside work_dir")
+
+    filepath = (work_dir_path / filename_path).resolve()
+    try:
+        filepath.relative_to(work_dir_path)
+    except ValueError as exc:
+        raise ValueError("filename must stay inside work_dir") from exc
+    return str(filepath)
+
+
 def execute_code(
     code: Optional[str] = None,
     timeout: Optional[int] = None,
@@ -246,7 +260,7 @@ def execute_code(
         filename = f"tmp_code_{code_hash}.{'py' if lang.startswith('python') else lang}"
     if work_dir is None:
         work_dir = WORKING_DIR
-    filepath = os.path.join(work_dir, filename)
+    filepath = _resolve_work_dir_filepath(work_dir, filename)
     file_dir = os.path.dirname(filepath)
     os.makedirs(file_dir, exist_ok=True)
     if code is not None:

packages/dbgpt-core/src/dbgpt/util/tests/test_code_utils.py

@@ -0,0 +1,73 @@
+from pathlib import Path
+
+import pytest
+
+from dbgpt.util.code_utils import execute_code
+
+
+def test_execute_code_rejects_filename_outside_work_dir(tmp_path: Path):
+    work_dir = tmp_path / "workspace"
+    outside_file = tmp_path / "outside.py"
+
+    with pytest.raises(ValueError, match="work_dir"):
+        execute_code(
+            "print('escaped')",
+            filename="../outside.py",
+            work_dir=str(work_dir),
+            use_docker=False,
+        )
+
+    assert not outside_file.exists()
+
+
+def test_execute_code_rejects_absolute_filename(tmp_path: Path):
+    work_dir = tmp_path / "workspace"
+    outside_file = tmp_path / "outside.py"
+
+    with pytest.raises(ValueError, match="relative path"):
+        execute_code(
+            "print('escaped')",
+            filename=str(outside_file),
+            work_dir=str(work_dir),
+            use_docker=False,
+        )
+
+    assert not outside_file.exists()
+
+
+def test_execute_code_allows_nested_filename_inside_work_dir(tmp_path: Path):
+    work_dir = tmp_path / "workspace"
+
+    exitcode, logs, image = execute_code(
+        "print('inside')",
+        filename="nested/script.py",
+        work_dir=str(work_dir),
+        use_docker=False,
+    )
+
+    assert exitcode == 0
+    assert logs == "inside\n"
+    assert image is None
+    assert (work_dir / "nested" / "script.py").exists()
+
+
+def test_execute_code_rejects_symlink_escape_from_work_dir(tmp_path: Path):
+    work_dir = tmp_path / "workspace"
+    outside_dir = tmp_path / "outside"
+    work_dir.mkdir()
+    outside_dir.mkdir()
+
+    try:
+        (work_dir / "linked").symlink_to(outside_dir, target_is_directory=True)
+    except OSError as exc:
+        pytest.skip(f"symlinks are not available in this environment: {exc}")
+
+    with pytest.raises(ValueError, match="work_dir"):
+        execute_code(
+            "print('escaped')",
+            filename="linked/escaped.py",
+            work_dir=str(work_dir),
+            use_docker=False,
+        )
+
+    assert not (outside_dir / "escaped.py").exists()