Antoine MoreauxGitHubCopilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>Potential fix for [https://github.com/twentyhq/twenty/security/code-scanning/173](https://github.com/twentyhq/twenty/security/code-scanning/173) To fix this vulnerability, ensure that any file path constructed from untrusted user input is strictly confined to the intended storage directory. This is best done through path normalization and validation. Before reading the file, the following steps should be taken: 1. **Resolve the file path**: Use `path.resolve` to normalize the resulting path, removing any ".." segments or symbolic links. 2. **Check the parent directory**: Ensure that the resolved path starts with the intended storage directory (`this.options.storagePath`). 3. **Throw an exception**: If the resolved path does not start with the storage root, throw an exception or otherwise deny the operation. This check should be placed in all methods that build a file path from user input in `local.driver.ts`, with at least the `read` method addressed. The index for this fix will be on lines that construct and use `filePath`, specifically in the `read` method. You will need to: - Import `realpathSync` from `fs` (standard library). - Add safe path resolution and containment check around file access. --- _Suggested fixes powered by Copilot Autofix. Review carefully before merging._ --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>