Summary
Copier's template URL handling allows percent-encoded parent-directory segments and path separators to bypass trusted repository prefix checks.
Under certain URL encoding conditions, templates from untrusted repositories can be treated as trusted, enabling unsafe template features to run after user interaction.
Affected context
This vulnerability affects environments where Copier is used to render project templates from URLs and relies on trusted repository prefixes for security.
It manifests when template URLs include percent-encoded .. segments or encoded path separators that are validated in their encoded form, but later decoded by HTTP or Git transports.
The issue is most relevant in workflows that permit templates with advanced or unsafe features under the assumption they originate only from trusted repositories.
Exploit preconditions
- Attack surface: Template URL input to Copier (CLI or library)
- Required access: Ability to supply or influence the template URL used by Copier
- Trigger point: Prefix validation on an encoded URL followed by path decoding by HTTP server or Git transport
- Why exploitation is possible: The trust check is performed on the raw, encoded path, while actual repository resolution uses a decoded path, allowing traversal or redirection outside the trusted prefix.
Why this happens
The core issue is a mismatch between validation and interpretation of user-supplied paths, aligning with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-180 (Incorrect Regular Expression or Input Validation).
Copier checks whether the encoded template URL starts with a trusted prefix, but does not normalize or decode the path before enforcing this restriction.
Downstream HTTP or Git transports then decode percent-encoded parent-directory segments and path separators, effectively changing the resolved repository location and bypassing the original trust boundary.
This pattern reflects a general class of bugs where validation is applied to one representation of input (encoded) and execution or access control is performed on another (decoded or normalized).
Potential impact
- Templates from untrusted repositories may run with the same privileges as trusted templates
- Unsafe template features can be executed, potentially running arbitrary code or commands during project generation
- Project scaffolds may include malicious configuration, scripts, or dependencies
- Users and build environments can be exposed to supply-chain attacks via compromised template sources
General mitigation guidance
Effective mitigation focuses on tightly controlling path resolution and trust boundaries around template URLs.
Useful defensive patterns include:
- Normalizing and decoding paths before applying prefix or trust checks, ensuring validation matches the final resolved location
- Rejecting or strictly constraining the use of parent-directory segments and encoded path separators in template URLs
- Applying a clear separation between trusted and untrusted templates, disabling unsafe or code-executing features for untrusted sources by default
- Running template rendering with least privilege, so that even if untrusted logic executes, its ability to affect the broader system is minimized
- Treating network-retrieved templates as untrusted unless explicitly verified, and reducing reliance on implicit trust based on path segments alone
How teams detect issues like this
Organizations can identify similar vulnerabilities by:
- Reviewing code paths where URLs or filesystem paths are validated in one representation (e.g., encoded) but used after transformation (e.g., decoded or normalized)
- Applying static analysis rules that flag reliance on prefix checks without normalization for path, URL, or repository validation
- Inspecting template handling logic for any allowance of
..segments or encoded path separators reaching repository resolution layers - Enforcing security policies that require centralized path normalization utilities and forbid ad-hoc trust checks on raw input strings
- Using automated code review tools configured to detect CWE-22 and CWE-180 patterns, especially around Git and HTTP transport integration
