MCP server: allow absolute attachment paths via operator-configured roots

mcpserver/tools/file_utils.go

@@ -107,6 +107,46 @@ func EnsureDataDirectory() error {
 	return os.MkdirAll(dataDir, 0700)
 }
 
+// AttachmentRootsEnvVar names the environment variable listing extra directories
+// (separated by the OS path-list separator, e.g. ":" on Unix) that local-mode
+// attachments may be read from using absolute paths. Relative paths always
+// resolve inside the data directory regardless of this setting.
+const AttachmentRootsEnvVar = "MM_MCP_ATTACHMENT_ROOTS"
+
+// readLocalFileFromAllowedRoots reads an absolute attachment path, but only when it
+// falls under one of the operator-configured attachment roots. Each root is opened
+// via os.Root so symlinks cannot escape the allowed directory.
+func readLocalFileFromAllowedRoots(absPath string) ([]byte, error) {
+	for _, rootDir := range filepath.SplitList(os.Getenv(AttachmentRootsEnvVar)) {
+		rootDir = strings.TrimSpace(rootDir)
+		if rootDir == "" || !filepath.IsAbs(rootDir) {
+			continue
+		}
+		rootDir = filepath.Clean(rootDir)
+
+		rel, err := filepath.Rel(rootDir, absPath)
+		if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+			continue
+		}
+
+		root, err := os.OpenRoot(rootDir)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open attachment root %q: %w", rootDir, err)
+		}
+		defer root.Close()
+
+		file, err := root.Open(rel)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open file: %w", err)
+		}
+		defer file.Close()
+
+		return readLimitedToMaxMCPBytes(file)
+	}
+
+	return nil, fmt.Errorf("absolute path %q is not inside any allowed attachment root; set the %s environment variable on the MCP server, or use a path relative to the data directory", absPath, AttachmentRootsEnvVar)
+}
+
 // fetchFileDataForLocal fetches file data from a file path or URL (local access only)
 func fetchFileDataForLocal(ctx context.Context, filespec string, accessMode AccessMode) ([]byte, error) {
 	if filespec == "" {
@@ -156,6 +196,11 @@ func fetchFileDataForLocal(ctx context.Context, filespec string, accessMode Acce
 
 	cleanPath := filepath.Clean(filespec)
 
+	// Absolute paths are only served from operator-configured attachment roots.
+	if filepath.IsAbs(cleanPath) {
+		return readLocalFileFromAllowedRoots(cleanPath)
+	}
+
 	// Use data directory as base for file operations
 	dataDir, err := GetDataDirectoryInternal()
 	if err != nil {

mcpserver/tools/file_utils_test.go

@@ -6,6 +6,8 @@ package tools
 import (
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -43,3 +45,92 @@ func TestFetchFileDataForLocal_InvalidURLSpecs(t *testing.T) {
 		})
 	}
 }
+
+func TestFetchFileDataForLocal_AbsolutePathRoots(t *testing.T) {
+	allowedDir := t.TempDir()
+	otherDir := t.TempDir()
+
+	fileContent := []byte("attachment payload")
+	allowedFile := filepath.Join(allowedDir, "report.txt")
+	require.NoError(t, os.WriteFile(allowedFile, fileContent, 0600))
+
+	nestedFile := filepath.Join(allowedDir, "sub", "nested.txt")
+	require.NoError(t, os.MkdirAll(filepath.Dir(nestedFile), 0700))
+	require.NoError(t, os.WriteFile(nestedFile, fileContent, 0600))
+
+	outsideFile := filepath.Join(otherDir, "secret.txt")
+	require.NoError(t, os.WriteFile(outsideFile, fileContent, 0600))
+
+	linkToOutside := filepath.Join(allowedDir, "escape-link")
+	require.NoError(t, os.Symlink(outsideFile, linkToOutside))
+
+	testCases := []struct {
+		name     string
+		roots    string
+		filespec string
+		wantData bool
+	}{
+		{
+			name:     "no roots configured rejects absolute paths",
+			roots:    "",
+			filespec: allowedFile,
+			wantData: false,
+		},
+		{
+			name:     "file inside an allowed root is readable",
+			roots:    allowedDir,
+			filespec: allowedFile,
+			wantData: true,
+		},
+		{
+			name:     "nested file inside an allowed root is readable",
+			roots:    allowedDir,
+			filespec: nestedFile,
+			wantData: true,
+		},
+		{
+			name:     "second entry in the root list also matches",
+			roots:    otherDir + string(filepath.ListSeparator) + allowedDir,
+			filespec: allowedFile,
+			wantData: true,
+		},
+		{
+			name:     "file outside every allowed root is rejected",
+			roots:    allowedDir,
+			filespec: outsideFile,
+			wantData: false,
+		},
+		{
+			name:     "path traversal out of an allowed root is rejected",
+			roots:    allowedDir,
+			filespec: filepath.Join(allowedDir, "..", filepath.Base(otherDir), "secret.txt"),
+			wantData: false,
+		},
+		{
+			name:     "symlink escaping an allowed root is rejected",
+			roots:    allowedDir,
+			filespec: linkToOutside,
+			wantData: false,
+		},
+		{
+			name:     "relative root entries are ignored",
+			roots:    "relative/dir",
+			filespec: allowedFile,
+			wantData: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(AttachmentRootsEnvVar, tc.roots)
+
+			data, err := fetchFileDataForLocal(t.Context(), tc.filespec, AccessModeLocal)
+			if tc.wantData {
+				require.NoError(t, err)
+				require.Equal(t, fileContent, data)
+			} else {
+				require.Error(t, err)
+			}
+		})
+	}
+}