Repository navigation
fix(cli): validate session ids - #2475
Merged
Merged
Conversation
Added robust UUID validation for the `sessionId` parameter to prevent arbitrary file write and path traversal vulnerabilities. The validation is enforced at CLI entry points, daemon startup, and inside utility path-resolution functions as a defense-in-depth measure. Invalid session IDs containing path manipulation characters (e.g., `../`) will now throw an error. Co-authored-by: OrKoN <399150+OrKoN@users.noreply.github.com>
Contributor
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Added robust UUID validation for the `sessionId` parameter to prevent arbitrary file write and path traversal vulnerabilities. The validation is enforced at CLI entry points, daemon startup, and inside utility path-resolution functions as a defense-in-depth measure. Invalid session IDs containing path manipulation characters (e.g., `../`) will now throw an error. Co-authored-by: OrKoN <399150+OrKoN@users.noreply.github.com>
OrKoN
changed the title
OrKoN
force-pushed
the
fix-path-traversal-sessionid-16000164307153409218
branch
from
August 5, 2026 09:29
34ec1a9 to
1606c94
Compare
OrKoN
marked this pull request as ready for review
August 5, 2026 09:40
zyzyzyryxy
requested changes
Aug 5, 2026
zyzyzyryxy
left a comment
zyzyzyryxy
left a comment
Contributor
There was a problem hiding this comment.
Looks like unfinished with amount of unintentional changes included.
The core of the change looks ok though.
OrKoN
force-pushed
the
fix-path-traversal-sessionid-16000164307153409218
branch
from
August 5, 2026 12:52
30ba87b to
1606c94
Compare
Collaborator
Author
These changes are already in the main branch :) |
Contributor
Acknowledged. |
zyzyzyryxy
approved these changes
Aug 5, 2026
zyzyzyryxy
left a comment
zyzyzyryxy
left a comment
Contributor
There was a problem hiding this comment.
I guess I didn't notice the diff included merge commit then, sorry :-)
LGTM
OrKoN
enabled auto-merge
August 5, 2026 12:58
OrKoN
pushed a commit
to LuHuangMSFT/chrome-devtools-mcp
that referenced
this pull request
Aug 10, 2026
🤖 I have created a release *beep* *boop* --- ## [1.7.0](ChromeDevTools/chrome-devtools-mcp@chrome-devtools-mcp-v1.6.0...chrome-devtools-mcp-v1.7.0) (2026-08-10) ### 🎉 Features * add a utility function to check for localhost. ([ChromeDevTools#2454](ChromeDevTools#2454)) ([c5ebf9e](ChromeDevTools@c5ebf9e)) * Add get_heapsnapshot_object_details MCP tool ([ChromeDevTools#2374](ChromeDevTools#2374)) ([8432cb9](ChromeDevTools@8432cb9)) * Emit native contexts in snapshot summary ([ChromeDevTools#2375](ChromeDevTools#2375)) ([f78a911](ChromeDevTools@f78a911)) * Filter heap snapshot objects by native context ([ChromeDevTools#2377](ChromeDevTools#2377)) ([76fd242](ChromeDevTools@76fd242)) * **telemetry:** log devtools data. ([ChromeDevTools#2460](ChromeDevTools#2460)) ([df2c753](ChromeDevTools@df2c753)) * **telemetry:** log is_devtools_open with each tool call. ([ChromeDevTools#2445](ChromeDevTools#2445)) ([6f60eab](ChromeDevTools@6f60eab)) * **telemetry:** report whether tool call is made on localhost. ([ChromeDevTools#2455](ChromeDevTools#2455)) ([6398b7e](ChromeDevTools@6398b7e)) * update lighthouse to 13.4.1 ([ChromeDevTools#2398](ChromeDevTools#2398)) ([745ffe7](ChromeDevTools@745ffe7)) ### 🛠️ Fixes * bound per-navigation network request retention ([ChromeDevTools#2435](ChromeDevTools#2435)) ([b08c73c](ChromeDevTools@b08c73c)) * **cli:** validate session ids ([ChromeDevTools#2475](ChromeDevTools#2475)) ([5ca9121](ChromeDevTools@5ca9121)) * **cli:** warn about version mismatch between cli and daemon ([ChromeDevTools#2461](ChromeDevTools#2461)) ([3afc44d](ChromeDevTools@3afc44d)) * **daemon:** preserve hyphenated browser flags in arg serialization and lazy daemon startup ([ChromeDevTools#2405](ChromeDevTools#2405)) ([d79f3ba](ChromeDevTools@d79f3ba)) * dispose heap snapshot workers on context teardown ([ChromeDevTools#2428](ChromeDevTools#2428)) ([f245c76](ChromeDevTools@f245c76)) * do not throw synchronously when a CDP session is gone ([ChromeDevTools#2466](ChromeDevTools#2466)) ([ba4fe3e](ChromeDevTools@ba4fe3e)) * don't throw if Dialog was handled ([ChromeDevTools#2437](ChromeDevTools#2437)) ([574c320](ChromeDevTools@574c320)) * downscale viewport screenshots when no viewport is emulated ([ChromeDevTools#2380](ChromeDevTools#2380)) ([39c4140](ChromeDevTools@39c4140)) * improve daemon lifecycle ([ChromeDevTools#2360](ChromeDevTools#2360)) ([3ee6a27](ChromeDevTools@3ee6a27)) * improve file writing ([ChromeDevTools#2447](ChromeDevTools#2447)) ([1da4bb0](ChromeDevTools@1da4bb0)) * include the tab id in `get_tab_id`'s text response ([ChromeDevTools#2381](ChromeDevTools#2381)) ([dcbaf49](ChromeDevTools@dcbaf49)) * **memory:** dispose the heap-snapshot worker when loading fails ([ChromeDevTools#2449](ChromeDevTools#2449)) ([744738d](ChromeDevTools@744738d)) * **performance:** reset trace-running flag when start_trace setup fails ([ChromeDevTools#2420](ChromeDevTools#2420)) ([40240c0](ChromeDevTools@40240c0)) * regression after the [ChromeDevTools#2443](ChromeDevTools#2443) ([ChromeDevTools#2462](ChromeDevTools#2462)) ([4c80ce4](ChromeDevTools@4c80ce4)) * rename maxRetainedSize column ([ChromeDevTools#2402](ChromeDevTools#2402)) ([75c7048](ChromeDevTools@75c7048)) * **screenshot:** dispose element handle after take_screenshot ([ChromeDevTools#2422](ChromeDevTools#2422)) ([fffb40e](ChromeDevTools@fffb40e)) * toggle lazy loading for source maps. ([ChromeDevTools#2486](ChromeDevTools#2486)) ([8028bfe](ChromeDevTools@8028bfe)) * **wait:** avoid 180s mutex stall when a dialog opens during an action ([ChromeDevTools#2427](ChromeDevTools#2427)) ([b4e8f74](ChromeDevTools@b4e8f74)) ### 📄 Documentation * Add devin cli install instruction to README ([ChromeDevTools#2361](ChromeDevTools#2361)) ([45262c0](ChromeDevTools@45262c0)) * correct the user data directory documentation ([ChromeDevTools#2473](ChromeDevTools#2473)) ([5ddbffd](ChromeDevTools@5ddbffd)) * **skills:** update memory leak debugging skill to use native MCP tools ([ChromeDevTools#2436](ChromeDevTools#2436)) ([99bd90a](ChromeDevTools@99bd90a)) * Update Chrome requirement for categoryExperimentalWebmcp ([ChromeDevTools#2163](ChromeDevTools#2163)) ([354458e](ChromeDevTools@354458e)) * update security.md ([ChromeDevTools#2362](ChromeDevTools#2362)) ([5012b07](ChromeDevTools@5012b07)) ### 🏗️ Refactor * clean up McpResponse.handle ([ChromeDevTools#2392](ChromeDevTools#2392)) ([348975d](ChromeDevTools@348975d)) * introduce Explicit resouce managent (using) ([ChromeDevTools#2443](ChromeDevTools#2443)) ([5b25370](ChromeDevTools@5b25370)) * move tool groups ([ChromeDevTools#2365](ChromeDevTools#2365)) ([2d944f9](ChromeDevTools@2d944f9)) * re-use Puppteer Mutex ([ChromeDevTools#2444](ChromeDevTools#2444)) ([775ea2d](ChromeDevTools@775ea2d)) * rename methods for clarity ([ChromeDevTools#2442](ChromeDevTools#2442)) ([dc23bcd](ChromeDevTools@dc23bcd)) * use a destructor to shorten the calls ([ChromeDevTools#2376](ChromeDevTools#2376)) ([77e1d3f](ChromeDevTools@77e1d3f)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 What: The vulnerability fixed is a Path Traversal issue involving the
sessionIdstring. Previously, the system appended thesessionIdto file paths without validating it, allowing attackers to inject malicious characters (like../) and manipulate paths (e.g.server.sockordaemon.pid).🛡️ Solution: The fix introduces a new
assertValidSessionIdutility that enforces strict UUID character validation (/^[a-fA-F0-9-]+$/). If an invalid payload is found, an Error is thrown immediately. This validation check has been added to CLI options, daemon startup routines, and deeply within the utility methods likegetSocketPathandgetRuntimeHometo provide a defense-in-depth approach. Unit tests have been added to verify that valid paths pass and traversal attempts are successfully blocked.PR created automatically by Jules for task 16000164307153409218 started by @OrKoN