How HKUDS/CLI-Anything Path Validation Prevents Directory Traversal When Loading Token Files

CLI-Anything prevents directory traversal attacks by using hardcoded absolute paths rooted in the user's home directory, rejecting all user-controlled path input, and enforcing strict file permissions.

The HKUDS/CLI-Anything repository implements a robust security model for Zoom OAuth token storage that eliminates directory traversal vulnerabilities entirely. Rather than sanitizing or validating external path input, the codebase removes user control from the path construction process—ensuring token files can only be accessed from a single, predetermined location.

How Token Paths Are Constructed in CLI-Anything

In zoom/utils/zoom_backend.py, the configuration directory and token file paths are defined as constants using Python's pathlib:

# zoom/utils/zoom_backend.py

CONFIG_DIR = Path.home() / ".cli-anything-zoom"
TOKEN_FILE = CONFIG_DIR / "tokens.json"

This design makes two critical security guarantees:

• Path.home() uses the operating system's verified home directory—never a user-provided string
• tokens.json is a constant filename, not a parameter or configurable value

Because both components are fixed at import time, no attacker-controlled data can influence the final resolved path.

The Token Loading Implementation

The load_tokens() function demonstrates this security model in practice:

def load_tokens() -> dict:
    """Load saved OAuth tokens from disk."""
    if not TOKEN_FILE.exists():
        return {}
    with open(TOKEN_FILE, "r") as f:
        return json.load(f)

Notice that load_tokens() accepts zero parameters. There is no path argument, no optional directory override, and no environment variable fallback. The function uses only the pre-defined TOKEN_FILE constant, making path manipulation impossible.

Permission Enforcement via _restrict_path

CLI-Anything layers additional protection through permission restrictions. The _restrict_path helper (lines 31–41 in zoom/utils/zoom_backend.py) ensures that:

• The config directory receives 0o700 permissions (owner read/write/execute only)
• The token file receives 0o600 permissions (owner read/write only)

On Windows, the equivalent restrictions are applied using icacls. This prevents other users or processes from reading sensitive OAuth tokens even if they gain filesystem access.

The get_config_dir function (lines 56–60) creates the directory with these safe defaults:

def get_config_dir() -> Path:
    """Ensure config directory exists with safe permissions."""
    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    _restrict_path(CONFIG_DIR, 0o700)
    return CONFIG_DIR

Security Comparison: Input Validation vs. Elimination of Input

Most directory traversal defenses rely on input sanitization—stripping ../ sequences or resolving paths against an allowlist. CLI-Anything uses a stronger approach:

Approach	Vulnerability Risk	Implementation Complexity
Input validation	Re-encoding attacks, bypass techniques	High—requires constant updates
No user input (CLI-Anything's model)	None—attack surface eliminated	Low—fixed paths at compile time

By design, CLI-Anything's token storage cannot be exploited via directory traversal because the path is never constructed from untrusted data.

Practical Code Examples

Loading existing tokens safely:

from cli_anything.zoom.utils.zoom_backend import load_tokens

tokens = load_tokens()
if tokens:
    print("Access token:", tokens["access_token"])
else:
    print("No token file found—run auth login first.")

Saving new tokens with enforced permissions:

from cli_anything.zoom.utils.zoom_backend import save_tokens

new_tokens = {
    "access_token": "at_123",
    "refresh_token": "rt_456",
    "expires_in": 3600,
}
save_tokens(new_tokens)  # Writes to ~/.cli-anything-zoom/tokens.json with 600 perms

Both operations are inherently safe—the library controls every aspect of file location and access.

Summary

• Fixed paths eliminate traversal vectors: CONFIG_DIR and TOKEN_FILE are constants derived solely from Path.home() and hardcoded filenames
• Zero user input: Neither load_tokens() nor save_tokens() accepts path parameters
• Strict permissions: _restrict_path enforces 0o700 on directories and 0o600 on token files
• Cross-platform: Permission model adapts to Unix (chmod) and Windows (icacls) systems

These mechanisms, implemented in zoom/utils/zoom_backend.py, ensure that Zoom OAuth tokens in CLI-Anything remain protected against directory traversal attacks without relying on runtime validation logic.

Frequently Asked Questions

Can users override the token file location via environment variables?

No. The token file path is hardcoded as Path.home() / ".cli-anything-zoom" / "tokens.json" with no environment variable fallback. Users cannot redirect token storage without modifying source code.

What prevents other applications from accessing the token file?

The _restrict_path helper sets filesystem permissions to owner-only access (0o600 for files, 0o700 for directories). This is enforced at creation time and verified on subsequent operations.

Is the token loading vulnerable to symlink attacks?

The implementation uses standard Python file operations on fixed paths. While symlink attacks on the home directory itself are outside the application's threat model, the fixed path design prevents attackers from redirecting access through relative path manipulation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}