@mintlify/link-rot 3.0.840 → 3.0.841

package/dist/link-renaming/renameFileAndUpdateLinksInContent.js

@@ -20,6 +20,14 @@ import { existsSync, renameSync } from 'fs';
 import path from 'path';
 import { removeFileExtension, getPagePaths, addLeadingSlash } from '../prebuild.js';
 import renameInternalLinksInPage from './renameInternalLinksInPage.js';
+const validatePathWithinCwd = (inputPath) => {
+    const baseDir = process.cwd();
+    const resolvedPath = path.resolve(baseDir, inputPath);
+    const relative = path.relative(baseDir, resolvedPath);
+    if (relative.startsWith(`..${path.sep}`) || relative === '..' || path.isAbsolute(relative)) {
+        throw new Error(`Access denied: path "${inputPath}" is outside the current directory`);
+    }
+};
 /**
  * Renames a link in the file system. If the link is a directory, all links within the directory will be renamed as well.
  * @param oldFilePath - The existing directory or file to rename
@@ -31,6 +39,9 @@ export const renameFilesAndUpdateLinksInContent = (oldFilePathString_1, newFileP
     const oldFilePath = path.parse(path.normalize(oldFilePathString));
     const newFilePath = path.parse(path.normalize(newFilePathString));
     try {
+        // Validate paths are within current working directory to prevent path traversal
+        validatePathWithinCwd(oldFilePathString);
+        validatePathWithinCwd(newFilePathString);
         if (oldFilePath.dir === newFilePath.dir && oldFilePath.base === newFilePath.base) {
             throw new Error('the two file paths are the same.');
         }