A file tool receives reports/summary.md. Joining it to a workspace root seems straightforward. The hard cases begin when the request names an absolute path, crosses a symlink, or reaches a directory another process can change.
The security decision concerns the object the operating system opens.
Review the path transformations
The advisory collection includes arbitrary file access in MCP Atlassian, NotebookLM MCP, and AWS CodeWhisperer language tooling. These are separate implementation flaws. The matrix below describes general failure modes to check in your own tools.
| Shortcut | Why it can fail | Stronger direction |
|---|---|---|
Reject the literal string ../ |
Encodings and platform separators may differ | Parse with the platform's path rules |
| Check a string prefix | A sibling directory can share the prefix | Compare resolved path components |
| Resolve once, open later | A link or directory can change between operations | Use descriptor-relative or handle-based controls where supported |
| Validate the archive name | Individual entries can escape the extraction root | Authorize every entry and bound extraction |
| Give every file tool one broad mount | Read access becomes overwrite or deletion authority | Separate operations and mounts by need |
Canonicalization is useful, but timing matters
Resolve the intended root and target, account for symbolic links, and verify containment using filesystem-aware operations. A correct containment check can still race if an attacker can replace a path component before the open.
Prefer operating-system facilities that constrain resolution relative to an already opened directory or trusted handle. The exact APIs differ by platform. Avoid presenting a simple resolve() followed by open() as a complete race-resistant solution.
For new files, policy also needs to cover the parent directory and replacement behavior. Decide whether overwriting an existing file is permitted and how links are handled.
Give each file verb a separate permission
A search tool needs reads. A report exporter needs creates in one output directory. Neither necessarily needs rename, overwrite, or delete.
This distinction makes approvals clearer and reduces the consequence of a path-validation mistake. It also gives incident responders a smaller set of possible actions to investigate.
For archive extraction, bound entry count, expanded bytes, and nesting depth. File confinement does not by itself prevent a decompression bomb.
A test that proves something
Place a harmless canary outside the allowed root. Try to reach it through traversal, links, alternate path representations, and concurrent path changes. Run the same cases for upload, download, rename, and archive extraction.
Reinforce the application logic with a dedicated identity, read-only mounts, and narrow writable volumes. The process should have no filesystem view of credentials it never needs.