Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

@@ -21,6 +21,7 @@ import (
 	"github.com/dagu-org/dagu/internal/cmn/eval"
 	"github.com/dagu-org/dagu/internal/cmn/logger"
 	"github.com/dagu-org/dagu/internal/cmn/logger/tag"
+	"github.com/dagu-org/dagu/internal/core"
 	"github.com/dagu-org/dagu/internal/core/baseconfig"
 	"github.com/dagu-org/dagu/internal/core/exec"
 	"github.com/dagu-org/dagu/internal/license"
@@ -303,16 +304,59 @@ func (a *API) ConfigureRoutes(ctx context.Context, r chi.Router, baseURL string)
 		r.Use(WithRemoteNode(a.remoteNodeResolver, a.apiBasePath))
 		r.Use(WebhookRawBodyMiddleware())
 
+		middlewares := []api.StrictMiddlewareFunc{validateDAGFileNameMiddleware}
 		options := api.StrictHTTPServerOptions{
 			ResponseErrorHandlerFunc: a.handleError,
 		}
-		handler := api.NewStrictHandlerWithOptions(a, nil, options)
+		handler := api.NewStrictHandlerWithOptions(a, middlewares, options)
 		r.Mount("/", api.Handler(handler))
 	})
 
 	return nil
 }
 
+func validateDAGFileNameMiddleware(
+	next api.StrictHandlerFunc,
+	_ string,
+) api.StrictHandlerFunc {
+	return func(ctx context.Context, w http.ResponseWriter, r *http.Request, request any) (any, error) {
+		if err := validateDAGFileNameFromRequest(request); err != nil {
+			return nil, err
+		}
+		return next(ctx, w, r, request)
+	}
+}
+
+func validateDAGFileNameFromRequest(request any) error {
+	v := reflect.ValueOf(request)
+	if !v.IsValid() {
+		return nil
+	}
+	if v.Kind() == reflect.Pointer {
+		if v.IsNil() {
+			return nil
+		}
+		v = v.Elem()
+	}
+	if v.Kind() != reflect.Struct {
+		return nil
+	}
+
+	fileName := v.FieldByName("FileName")
+	if !fileName.IsValid() || fileName.Kind() != reflect.String {
+		return nil
+	}
+
+	if err := core.ValidateDAGName(fileName.String()); err != nil {
+		return &Error{
+			HTTPStatus: http.StatusBadRequest,
+			Code:       api.ErrorCodeBadRequest,
+			Message:    err.Error(),
+		}
+	}
+	return nil
+}
+
 func (a *API) evaluateAndNormalizeURL(ctx context.Context, baseURL string) string {
 	if evaluated, err := eval.String(ctx, baseURL, eval.WithOSExpansion()); err != nil {
 		logger.Warn(ctx, "Failed to evaluate API base URL",

@@ -4,6 +4,7 @@
 package api_test
 
 import (
+	"bytes"
 	"fmt"
 	"net/http"
 	"testing"
@@ -29,6 +30,40 @@ func getJSONWhenAvailable(t *testing.T, server test.Server, url string, out any)
 	return true
 }
 
+func sendRawRequestStatus(
+	t *testing.T,
+	server test.Server,
+	method string,
+	requestPath string,
+	body []byte,
+) int {
+	t.Helper()
+
+	baseURL := fmt.Sprintf(
+		"http://%s:%d",
+		server.Config.Server.Host,
+		server.Config.Server.Port,
+	)
+	var bodyReader *bytes.Reader
+	if body == nil {
+		bodyReader = bytes.NewReader(nil)
+	} else {
+		bodyReader = bytes.NewReader(body)
+	}
+
+	req, err := http.NewRequest(method, baseURL+requestPath, bodyReader)
+	require.NoError(t, err)
+	req.URL.RawPath = requestPath
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = resp.Body.Close() })
+	return resp.StatusCode
+}
+
 func TestDAGWritesDisabledInReadOnlyMode(t *testing.T) {
 	// Setup server with gitSync.enabled=true, pushEnabled=false (read-only mode)
 	server := test.SetupServer(t, test.WithConfigMutator(func(cfg *config.Config) {
@@ -136,6 +171,45 @@ func TestCreateNewDAGPathTraversal(t *testing.T) {
 	})
 }
 
+func TestDAGFileNameRejectsEncodedTraversal(t *testing.T) {
+	server := test.SetupServer(t)
+
+	tests := []struct {
+		name       string
+		method     string
+		path       string
+		body       []byte
+		wantStatus int
+	}{
+		{
+			name:       "get spec",
+			method:     http.MethodGet,
+			path:       "/api/v1/dags/..%2F..%2Ftmp%2Fsecret/spec",
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name:       "delete dag",
+			method:     http.MethodDelete,
+			path:       "/api/v1/dags/..%2F..%2Ftmp%2Fsecret",
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name:       "start dag",
+			method:     http.MethodPost,
+			path:       "/api/v1/dags/..%2F..%2Ftmp%2Fsecret/start",
+			body:       []byte(`{}`),
+			wantStatus: http.StatusBadRequest,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			status := sendRawRequestStatus(t, server, tc.method, tc.path, tc.body)
+			require.Equal(t, tc.wantStatus, status)
+		})
+	}
+}
+
 func TestDAG(t *testing.T) {
 	server := test.SetupServer(t)
 

@@ -34,6 +34,21 @@ func TestParseTopicRejectsMalformedQuery(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestParseTopicRejectsDAGTraversalIdentifiers(t *testing.T) {
+	tests := []string{
+		"dag:../../tmp/secret.yaml",
+		"daghistory:..%2F..%2Ftmp%2Fsecret.yaml",
+		"dag:foo/bar",
+	}
+
+	for _, topic := range tests {
+		t.Run(topic, func(t *testing.T) {
+			_, err := ParseTopic(topic)
+			require.Error(t, err)
+		})
+	}
+}
+
 func TestParseInitialTopics(t *testing.T) {
 	query := map[string][]string{
 		"topic":  {"dag:test.yaml", "queueitems:default"},

@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"regexp"
 	"strings"
+
+	"github.com/dagu-org/dagu/internal/core"
 )
 
 var topicTypePattern = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
@@ -69,7 +71,15 @@ func canonicalizeTopicIdentifier(topicType TopicType, identifier string) (string
 			return pathPart, nil
 		}
 		return pathPart + "?" + queryPart, nil
-	case TopicTypeDAGRun, TopicTypeDAG, TopicTypeDAGHistory, TopicTypeStepLog, TopicTypeQueueItems, TopicTypeDoc:
+	case TopicTypeDAG, TopicTypeDAGHistory:
+		if identifier == "" {
+			return "", fmt.Errorf("topic %q requires an identifier", topicType)
+		}
+		if err := core.ValidateDAGName(identifier); err != nil {
+			return "", fmt.Errorf("invalid DAG file name: %w", err)
+		}
+		return identifier, nil
+	case TopicTypeDAGRun, TopicTypeStepLog, TopicTypeQueueItems, TopicTypeDoc:
 		if identifier == "" {
 			return "", fmt.Errorf("topic %q requires an identifier", topicType)
 		}