@decantr/verifier 1.0.4 → 1.0.6

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/index.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, realpathSync, readdirSync, readFileSync as readFileSync2 } from "fs";
 import { readFile } from "fs/promises";
 import { extname as extname2, isAbsolute, join as join2, relative, resolve } from "path";
 import { evaluateGuard, isV3, validateEssence } from "@decantr/essence-spec";
@@ -11162,8 +11162,18 @@ function critiqueSource({
     reviewPack
   };
 }
+function resolveProjectFilePath(projectRoot, filePath) {
+  const root = existsSync2(projectRoot) ? realpathSync.native(projectRoot) : resolve(projectRoot);
+  const candidatePath = isAbsolute(filePath) ? resolve(filePath) : resolve(root, filePath);
+  const resolvedPath = existsSync2(candidatePath) ? realpathSync.native(candidatePath) : candidatePath;
+  const relativePath = relative(root, resolvedPath);
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+    throw new Error(`Path escapes the project root: ${filePath}`);
+  }
+  return resolvedPath;
+}
 async function critiqueFile(filePath, projectRoot) {
-  const resolvedPath = isAbsolute(filePath) ? filePath : resolve(projectRoot, filePath);
+  const resolvedPath = resolveProjectFilePath(projectRoot, filePath);
   const code = await readFile(resolvedPath, "utf-8");
   const treatmentsCss = readTextIfExists(join2(projectRoot, "src", "styles", "treatments.css"));
   const reviewPack = loadReviewPack(projectRoot);