From baf6ed501b684f47048553d9034e8d3aa824950e Mon Sep 17 00:00:00 2001
From: Livio Spring <9405495+livio-a@users.noreply.github.com>
Date: Fri, 17 Jul 2026 08:23:31 +0200
Subject: [PATCH] Merge commit from fork

* fix(actions): prevent disk access via require

* add test to ensure native modules are still possible
---
 internal/actions/actions.go      |  9 ++++++--
 internal/actions/actions_test.go | 36 ++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/internal/actions/actions.go b/internal/actions/actions.go
index 5fa3a3c28..4a59d9e47 100644
--- a/internal/actions/actions.go
+++ b/internal/actions/actions.go
@@ -16,7 +16,10 @@ type Config struct {
 	HTTP HTTPConfig
 }
 
-var ErrHalt = errors.New("interrupt")
+var (
+	ErrHalt     = errors.New("interrupt")
+	ErrFileLoad = errors.New("file-based modules are disabled")
+)
 
 type jsAction func(fields, fields) error
 
@@ -88,7 +91,9 @@ func executeScript(config *runConfig, ctxParam contextFields, apiParam apiFields
 		apiParam(config.apiParam)
 	}
 
-	registry := new(require.Registry)
+	registry := require.NewRegistryWithLoader(func(path string) ([]byte, error) {
+		return nil, ErrFileLoad
+	})
 	registry.Enable(config.vm)
 
 	for name, loader := range config.modules {
diff --git a/internal/actions/actions_test.go b/internal/actions/actions_test.go
index d33b3082a..f085dd5a5 100644
--- a/internal/actions/actions_test.go
+++ b/internal/actions/actions_test.go
@@ -3,6 +3,7 @@ package actions
 import (
 	"context"
 	"errors"
+	"strings"
 	"testing"
 	"time"
 
@@ -56,6 +57,41 @@ function testFunc() {
 				return false
 			},
 		},
+		{
+			name: "require file is disabled",
+			args: args{
+				api: nil,
+				script: `
+require('./some-file.js');
+function testFunc() {}`,
+				name: "testFunc",
+				opts: []Option{},
+			},
+			wantErr: func(err error) bool {
+				gojaErr := new(goja.Exception)
+				if errors.As(err, &gojaErr) {
+					return strings.Contains(gojaErr.Value().String(), ErrFileLoad.Error())
+				}
+				return false
+			},
+		},
+		{
+			name: "require custom module still possible",
+			args: args{
+				api: nil,
+				script: `
+require('zitadel/http');
+function testFunc() {}`,
+				name: "testFunc",
+				opts: []Option{
+					// We need to pass the option to allow loading the module via require('zitadel/http') in the script.
+					// Otherwise, the loader will assume it's a file and fail.
+					// No client is needed here, because the module is not used.
+					WithHTTP(context.Background(), nil),
+				},
+			},
+			wantErr: func(err error) bool { return err == nil },
+		},
 	}
 
 	for _, tt := range tests {