fix(core): mitigate NTFS 8.3 short name (SFN) path by urielefrenvirtusa · Pull Request #29116 · google-gemini/gemini-cli

urielefrenvirtusa · 2026-08-28T16:55:50Z

Summary

This PR mitigates path traversal and blocklist not allowed paths on NTFS filesystems by handling Windows short names (SFNs, e.g. git~1, env~1,
node_m~1 and vscode~1) in both path normalization and the AllowedPathChecker safety engine.

Details

Enhanced the AllowedPathChecker blocklist logic to recognize common short-name patterns (git~, env~, node_m~, vscode~) followed by digits.
Corrected robust path resolution on Windows by checking fs.realpathSync.native when available on win32 to guarantee canonicalization of short names to long
names prior to check.
Added comprehensive unit tests in built-in.test.ts and paths.test.ts targeting NTFS 8.3 short name scenarios.

Related Issues

Closes Bug 462382408

How to Validate

Run the core unit tests:
npm test -w @google/gemini-cli-core -- src/safety/built-in.test.ts src/utils/paths.test.ts

Verify that the tests run successfully and all test cases (including NTFS 8.3 short names and case-insensitive check scenarios) pass.

Pre-Merge Checklist

… checker

gemini-code-assist · 2026-08-28T16:55:59Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses critical security vulnerabilities related to path traversal and blocklist bypasses on Windows NTFS filesystems. By explicitly handling 8.3 short name patterns and ensuring canonical path resolution, the safety engine is now better equipped to prevent unauthorized access to sensitive directories.

Highlights

NTFS Short Name Mitigation: Updated the AllowedPathChecker to detect and block NTFS 8.3 short name (SFN) patterns like git~~1, env~~1, node_m~~1, and vscode~~1.
Robust Path Resolution: Modified robustRealpath to utilize fs.realpathSync.native on Windows platforms, ensuring proper canonicalization of short names to long names.
Enhanced Test Coverage: Added comprehensive unit tests in built-in.test.ts to verify that sensitive paths accessed via SFNs are correctly identified and denied.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

google-cla · 2026-08-28T16:56:02Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

github-actions · 2026-08-28T16:56:19Z

📊 PR Size: size/L

Lines changed: 320
Additions: +238
Deletions: -82
Files changed: 15

gemini-code-assist

Code Review

This pull request enhances path safety checks by blocking NTFS 8.3 short names (SFNs) such as git~~1, env~~1, node_m~~1, and vscode~~1 to prevent security bypasses. It also updates robustRealpath to use fs.realpathSync.native on Windows. The review feedback highlights a potential issue where fs.realpathSync.native returns paths prefixed with volume namespaces on Windows, which can cause path comparison mismatches. It is recommended to strip these prefixes to ensure consistent path operations.

…indows

urielefrenvirtusa · 2026-08-28T17:19:25Z

/gemini review

gemini-code-assist

Code Review

This pull request enhances path safety checks by blocking NTFS 8.3 short names (SFNs) for sensitive directories and improves Windows path resolution by handling UNC and long path prefixes. The review feedback correctly identifies a critical security bypass where NTFS collision-based SFN generation (e.g., using hexadecimal hashes) could evade the current blocklist, and provides actionable regex suggestions to mitigate this vulnerability.

urielefrenvirtusa · 2026-08-28T17:44:23Z

/gemini review

gemini-code-assist

Code Review

This pull request enhances path safety checks and path resolution, particularly on Windows. It updates the AllowedPathChecker to block NTFS 8.3 short names (SFNs) and collision-based SFN formats for sensitive directories like .git, .env, node_modules, and .vscode. Additionally, it updates robustRealpath to use fs.realpathSync.native on Windows and correctly strip long path prefixes and UNC prefixes. Corresponding unit tests have been added to verify these security and path resolution improvements. I have no feedback to provide as the changes are well-implemented and covered by tests.

urielefrenvirtusa · 2026-08-31T18:43:50Z

/gemini review

gemini-code-assist

Code Review

This pull request enhances path validation and resolution security, particularly on Windows. It updates AllowedPathChecker to block sensitive paths specified via NTFS 8.3 short names (SFNs) and collision-based SFN formats for .git, .env, node_modules, and .vscode. Additionally, it updates robustRealpath to use fs.realpathSync.native on Windows and correctly strip Windows long path prefixes (UNC and standard). Corresponding unit tests have been added to verify these changes. I have no further feedback to provide.

urielefrenvirtusa · 2026-09-01T22:22:46Z

/Gemini review

gemini-code-assist

Code Review

This pull request introduces support for detecting and blocking NTFS 8.3 short names (SFNs) in the AllowedPathChecker to prevent security bypasses. It also updates robustRealpath on Windows to use fs.realpathSync.native and correctly normalize long path prefixes (such as \?\ and \?\UNC\). Comprehensive unit tests have been added to verify these changes. I have no feedback to provide as there are no review comments.

…e mocks

…les tests Updates packages/core/src/tools/read-many-files.test.ts to use resolveToRealPath when resolving temporary directories. This expands NTFS 8.3 short paths (SFNs) to canonical long names on Windows, resolving the final slow-test mismatch without affecting Linux or macOS.

urielefrenvirtusa · 2026-09-03T22:23:31Z

/Gemini review

gemini-code-assist

Code Review

This pull request enhances path validation and normalization to prevent security bypasses on Windows, specifically addressing NTFS 8.3 short names (SFNs) and long path prefixes (such as \?\ and \?\UNC\). It centralizes path-blocking logic into a new hasBlockedPathSegment utility that identifies blocked segments like .git, .env, node_modules, and gha-creds-*.json along with their SFN variations. Additionally, various tests and utilities have been updated to use resolveToRealPath for canonical path resolution. There are no review comments, so I have no feedback to provide.

_{Note: Security Review did not run due to the size of the PR.}

Adds a type check 'typeof resolved === string' in robustRealpath on Windows before slicing the prefix. This prevents TypeError crashes during testing on Windows when fs.realpathSync is stubbed/mocked and returns undefined.

urielefrenvirtusa · 2026-09-04T15:21:40Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces robust path validation and security checks, specifically addressing NTFS 8.3 short name (SFN) bypasses and Windows long path prefixes. It centralizes path segment blocking logic into a new helper function hasBlockedPathSegment and updates AllowedPathChecker and WorkspaceContext to use it. Additionally, it replaces direct fs.realpathSync calls with resolveToRealPath across various tests and files to ensure canonical resolution. The review feedback suggests optimizing performance by hoisting inline regular expressions used for SFN pattern matching to module-level constants in both paths.ts and built-in.ts to avoid recreating them inside loops.

_{Note: Security Review did not run due to the size of the PR.}

…regexes

urielefrenvirtusa · 2026-09-04T16:12:52Z

/Gemini review

gemini-code-assist

Code Review

This pull request enhances security and path resolution robustness by centralizing blocked path segment detection and adding support for NTFS 8.3 short names (SFNs) to prevent bypasses. It introduces a centralized hasBlockedPathSegment utility to identify sensitive paths (such as .git, .env, node_modules, and gha-creds-*.json) using both standard names and SFN regex patterns. Additionally, resolveToRealPath is updated to canonically handle Windows long path prefixes, and direct calls to fs.realpathSync across various test and source files are refactored to use this centralized utility. There are no review comments, and I have no feedback to provide.

_{Note: Security Review did not run due to the size of the PR.}

urielefrenvirtusa · 2026-09-04T19:31:22Z

/Gemini review

gemini-code-assist

Code Review

This pull request enhances path validation and security by introducing robust handling of Windows NTFS 8.3 short names (SFNs) and canonical path resolution. It centralizes path segment blocking logic into hasBlockedPathSegment in paths.ts to cover standard blocked directories (such as .git, .env, node_modules, and gha-creds-*.json) along with their SFN equivalents. Additionally, resolveToRealPath is updated to use fs.realpathSync.native on Windows and strip long path prefixes. The reviewer suggests optimizing the isSubpath check on Windows by only invoking the synchronous resolveToRealPath when a path contains a tilde (~), which is a characteristic of SFNs, thereby avoiding unnecessary filesystem I/O performance bottlenecks.

urielefrenvirtusa · 2026-09-04T19:37:23Z

/Gemini review

gemini-code-assist

Code Review

This pull request enhances path validation and resolution security, specifically addressing potential bypasses on Windows using NTFS 8.3 short names (SFNs) and long path prefixes. It centralizes path-blocking checks into a new hasBlockedPathSegment utility that detects sensitive paths (such as .git, .env, node_modules, and GitHub Actions credentials) and their SFN equivalents. Additionally, resolveToRealPath is updated to canonically handle Windows long path prefixes using fs.realpathSync.native. Extensive unit tests have been added to verify these security controls. There are no review comments, and I have no feedback to provide.

gemini-cli · 2026-09-05T01:42:19Z

Hi there! Thank you for your interest in contributing to Gemini CLI.

To ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'.

This PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding.

fix(core): mitigate NTFS 8.3 short name (SFN) path bypasses in safety…

a851afa

… checker

urielefrenvirtusa requested a review from a team as a code owner August 28, 2026 16:55

github-actions Bot added the size/s A small PR label Aug 28, 2026

gemini-code-assist Bot reviewed Aug 28, 2026

View reviewed changes

Comment thread packages/core/src/utils/paths.ts Outdated

fix(core): strip UNC and long path prefixes from native realpath on W…

fda83fd

…indows

github-actions Bot added the size/m A medium sized PR label Aug 28, 2026

gemini-code-assist Bot reviewed Aug 28, 2026

View reviewed changes

Comment thread packages/core/src/safety/built-in.ts Outdated

Comment thread packages/core/src/safety/built-in.ts Outdated

fix(core): make NTFS short name (SFN) detection collision-resistant

ba4b23d

gemini-code-assist Bot reviewed Aug 28, 2026

View reviewed changes

gemini-cli Bot added the status/need-issue Pull requests that need to have an associated issue. label Aug 28, 2026

urielefrenvirtusa changed the title ~~fix(core): mitigate NTFS 8.3 short name (SFN) path bypasses in safety…~~ fix(core): mitigate NTFS 8.3 short name (SFN) path Aug 28, 2026

This was referenced Aug 29, 2026

📊 AI CLI 工具社区动态日报 2026-08-29 litang9/big_model_radar#392

Open

📊 AI CLI 工具社区动态日报 2026-08-29 96loveslife/big_model_radar#400

Open

Merge branch 'main' into b_462382408

91885c0

gemini-code-assist Bot reviewed Aug 31, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 1, 2026

📊 AI CLI 工具社区动态日报 2026-09-01 96loveslife/big_model_radar#418

Open

urielefrenvirtusa added 3 commits September 1, 2026 18:36

test(core): fix punctuation in built-in safety checker tests

1868163

test(core): delegate native realpath mock to standard realpathSync

6d06fc1

Merge branch 'main' into b_462382408

1636e26

gemini-code-assist Bot reviewed Sep 1, 2026

View reviewed changes

DavidAPierce approved these changes Sep 2, 2026

View reviewed changes

DavidAPierce enabled auto-merge September 2, 2026 03:55

fix(core): align workspace path resolution and support realpath nativ…

9e12986

…e mocks

gemini-code-assist Bot reviewed Sep 3, 2026

View reviewed changes

Merge branch 'main' into b_462382408

0386af9

github-actions Bot mentioned this pull request Sep 4, 2026

📊 AI CLI 工具社区动态日报 2026-09-04 96loveslife/big_model_radar#435

Open

urielefrenvirtusa added 2 commits September 4, 2026 15:20

Merge branch 'origin/b_462382408' into b_462382408

9181fa4

gemini-code-assist Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread packages/core/src/utils/paths.ts

Comment thread packages/core/src/safety/built-in.ts

Comment thread packages/core/src/safety/built-in.ts Outdated

fix(core): resolve Windows namespace prefix escaping and extract SFN …

9955846

…regexes

gemini-code-assist Bot reviewed Sep 4, 2026

View reviewed changes

urielefrenvirtusa added 2 commits September 4, 2026 18:52

Merge branch 'upstream/main' into b_462382408

7ceed42

fix(core): resolve non-existent subpaths containing SFNs on Windows

f03cb69

gemini-code-assist Bot reviewed Sep 4, 2026

View reviewed changes

Comment thread packages/core/src/utils/paths.ts Outdated

perf(core): optimize isSubpath Windows SFN resolution check

fb7cd5e

gemini-code-assist Bot reviewed Sep 4, 2026

View reviewed changes

wissamblue69-dotcom approved these changes Sep 4, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 4, 2026

📊 AI CLI 工具社区动态日报 2026-09-05 litang9/big_model_radar#402

Open

gemini-cli Bot added the status/pr-nudge-sent label Sep 5, 2026

github-actions Bot mentioned this pull request Sep 5, 2026

📊 AI CLI 工具社区动态日报 2026-09-05 96loveslife/big_model_radar#440

Open

DavidAPierce added this pull request to the merge queue Sep 8, 2026

Merged via the queue into google-gemini:main with commit 24cab68 Sep 8, 2026
33 checks passed

This was referenced Sep 9, 2026

📊 AI CLI 工具社区动态日报 2026-09-09 96loveslife/big_model_radar#461

Open

📊 AI CLI 工具社区动态日报 2026-09-10 litang9/big_model_radar#412

Open

urielefrenvirtusa deleted the b_462382408 branch September 10, 2026 20:52

Conversation

urielefrenvirtusa commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

Related Issues

How to Validate

Pre-Merge Checklist

Uh oh!

gemini-code-assist Bot commented Aug 28, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

google-cla Bot commented Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

urielefrenvirtusa commented Aug 28, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

urielefrenvirtusa commented Aug 28, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

urielefrenvirtusa commented Aug 31, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

urielefrenvirtusa commented Sep 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

urielefrenvirtusa commented Sep 3, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

urielefrenvirtusa commented Sep 4, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

urielefrenvirtusa commented Sep 4, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

urielefrenvirtusa commented Sep 4, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

urielefrenvirtusa commented Sep 4, 2026

Uh oh!

urielefrenvirtusa commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading