Malicious repository symlinks escape the clone root during indexing #602

Affected versions: confirmed on main at commit d92819a (the project publishes no tagged release).

Summary

The repository walker used for both the wiki-structure listing and the RAG indexer (iterate_files in api/config.py) follows symlinks: it calls is_file(), which dereferences a symlink, with no is_symlink() guard. A submitted repository containing a symlink pointing outside the checkout (to any file the server process can read) has that symlink listed as a normal file, and the indexer's open() on it dereferences straight to the external target.

Details

for p in Path(root_dir).rglob("*"):
    if not p.is_file():   # follows the symlink
        continue
    ...
    results.append(os.path.relpath(p, root_dir)...)

# api/rag/pipeline.py
for relative_path in iterate_files(path, ...):
    file_path = Path(path) / relative_path
    with open(file_path, "r", ...) as f:   # dereferences the symlink
        content = f.read()

POC

(available upon request)

Impact

A repository author can commit a symlink (with an admitted extension) pointing to a server-readable file outside the checkout. Indexing that repository embeds the target's content into the wiki's RAG store, where it can later be recovered through chat/retrieval.

Suggested fix: skip symlinks during traversal rather than following them. A fix is included in the linked PR.

Fix: #596