agent keeps trying to acces files outside workspace even after we added validation
we built an mcp server with file tools scoped to /workspace and added server-side validatoin that checks if the path starts with /workspace. the agent (claude 3.5 sonnet dec update) still tries to acces ../../etc/passwd maybe 20% of the time when we ask it to "find all config files". the validatoin catches it but im worreid that the agent is even trying this in the first place. is this expected behavoir or did we mess up the tool descriptiion? should we add something like "never acces files outside /workspace" to the tool description or is that not going to help?
we hit this exact thing with a file read agent last month - kept trying ../../../ paths even after we added server-side validation. turned out the validation was checking the final resolved path but the agent was encoding the traversal in url encoding so it bypassed the check entirely. switched to rejecting any path with %2e%2e or .. before resolving and it stopped. do you validate before or after path resolution?
check if the validation is running before or after path normalization. we had this exact bug where the agent would send ../ and we'd normalize it to an absolute path *after* validation, so the validation passed but the normalized path was outside workspace
ok so this is the exact bug we hit last month. validation was running on the raw input path before normalization, so the agent would send ../../etc/passwd and we'd validate it (looks fine!), then normalize it to /etc/passwd (absolute path!), then allow it through. moved validation to after normalization and it fixed it completely
we hit this exact thing last week with a file search agent - kept trying to access ../../../etc/passwd even after we added path validation. turned out the validation was running client-side and the model was just ignoring it lol. moved validation to the server and logged every rejected call to postgres, drops from maybe 40% escape attempts to zero. what's your validation layer - client or server?