제출 #864288: Roo-Code v3.51.1 Path Traversal

### Description

Roo-Code's ApplyPatchTool does not validate file paths in patch files, allowing attackers to modify files outside the workspace boundary through path traversal attacks. The tool uses `path.resolve(task.cwd, relPath)` to construct file paths without validating that the resolved path remains within the workspace.

Vulnerable code location:
```typescript
// src/core/tools/ApplyPatchTool.ts:85
const targetPath = path.resolve(task.cwd, relPath); // ❌ No boundary check
```

The vulnerability chain:
1. `ApplyPatchTool` resolves relative paths without boundary checking (ASI05-001)
2. Workspace boundary check (SF-10) is only implemented in WriteToFileTool, not ApplyPatchTool
3. No validation that resolved path is within workspace
4. Patch files from untrusted sources are processed without sanitization

This allows attackers to distribute malicious patch files that modify critical system files (e.g., `~/.ssh/authorized_keys`, `~/.bashrc`) when victims apply them, achieving persistent system access.

### Root cause

- Entry route:
Patch file application via ApplyPatchTool
- Preconditions:
Victim downloads and applies malicious patch file
- Vulnerable code:
`src/core/tools/ApplyPatchTool.ts:85` - Path resolution without boundary check
- Root cause:
ApplyPatchTool resolves relative paths without validating that the resolved path remains within the workspace boundary
- Controlling factor:
Workspace boundary check (SF-10) not implemented in ApplyPatchTool

### Proof of Concept

**Malicious Patch File (malicious.patch):**

```diff
--- ../../.ssh/authorized_keys
+++ ../../.ssh/authorized_keys
@@ -1,0 +1,1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8h3fj2kF... [email protected]
```

**Attack Steps:**
1. Attacker creates malicious patch file with path traversal sequences (`../`)
2. Patch is distributed via social engineering:
- Email: "Urgent security fix for your project"
- GitHub issue: "Please apply this performance patch"
- Slack/Discord: "Here's the fix for that bug"
- Pull request comment: "Apply this patch to resolve the issue"
3. Victim downloads the patch file to their workspace
4. Victim asks Roo-Code: "Please apply the patch file malicious.patch"
5. Agent calls ApplyPatchTool with the malicious patch
6. Tool resolves `../../.ssh/authorized_keys` without boundary validation
7. Patch is applied, modifying file outside workspace
8. Attacker's SSH public key is added to `~/.ssh/authorized_keys`
9. Attacker gains persistent SSH access to victim's machine

### Expected behaviour

ApplyPatchTool should validate that all file paths in patch files remain within the workspace boundary and reject patches with path traversal sequences.

### Observed behaviour

Agent executes `patch < malicious.patch`, resolves path traversal sequences, modifies files outside workspace (e.g., `~/.ssh/authorized_keys`), and reports success without any warning or boundary check failure.

### CWE Classification

- CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
- CWE-73: External Control of File Name or Path
- CWE-434: Unrestricted Upload of File with Dangerous Type

• 원천: ⚠️ https://gist.github.com/tchen200311/c5b8eeb9b7f8e4e6f19e7432d7bb1e31
• 사용자: tchen200311 (UID 97733)
• 제출: 2026. 06. 20. AM 04:01 (2 개월 ago)
• 모더레이션: 2026. 08. 27. PM 04:50 (2 months later)
• 상태: 수락
• VulDB 항목: 396170 [RooCodeInc Roo-Code 까지 3.51.1 ApplyPatchTool ApplyPatchTool.ts path.resolve 디렉토리 순회]
• 포인트들: 20