Function: isContainedPath()

isContainedPath(resolvedPath, allowedBase): boolean

Defined in: security/FolderPermissions.ts:343

Validates that a resolved path stays within its expected parent directory. Prevents path traversal attacks via symlinks or .. sequences.

Ported from OpenClaw upstream security fix for plugin/hook path containment.

Parameters

resolvedPath

string

The path to validate (already resolved via path.resolve)

allowedBase

string

The base directory the path must stay within

Returns

boolean

True if the path is contained within allowedBase

Example

isContainedPath('/home/user/workspace/file.txt', '/home/user/workspace') → true
isContainedPath('/etc/passwd', '/home/user/workspace') → false