@theokit/sdk 4.19.3 → 4.19.4

package/dist/eval.js

@@ -2,7 +2,7 @@ import { z, toJSONSchema } from 'zod';
 import { createRequire } from 'module';
 import { randomUUID, randomBytes, createHash } from 'crypto';
 import { mkdir, readFile, open, rename, unlink, writeFile, statfs, readdir, stat, access } from 'fs/promises';
-import { join, dirname, resolve, sep, relative, isAbsolute } from 'path';
+import { join, dirname, resolve, relative, sep, isAbsolute } from 'path';
 import { readFileSync, existsSync, mkdirSync, appendFileSync, realpathSync, lstatSync, readlinkSync, readdirSync, statSync, chmodSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, unlinkSync } from 'fs';
 import { homedir } from 'os';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -847,6 +847,11 @@ var init_atomic_write = __esm({
     warnedNfsDirs = /* @__PURE__ */ new Set();
   }
 });
+function isInside(target, base) {
+  if (target === base) return true;
+  const prefix = base.endsWith(sep) ? base : base + sep;
+  return target.startsWith(prefix);
+}
 function safePathJoin(base, ...parts) {
   if (base === "") {
     throw new Error("safePathJoin: base must be non-empty");
@@ -857,8 +862,7 @@ function safePathJoin(base, ...parts) {
   }
   const baseResolved = resolve(base);
   const target = resolve(base, ...parts);
-  const prefix = baseResolved.endsWith(sep) ? baseResolved : baseResolved + sep;
-  if (target !== baseResolved && !target.startsWith(prefix)) {
+  if (!isInside(target, baseResolved)) {
     throw new PathTraversalError(parts.join("/"), target);
   }
   return target;
@@ -883,7 +887,7 @@ function assertNoSymlinkEscape(path, base) {
   }
   const resolved = realpathOfDeepestExisting(path);
   if (resolved === void 0) return;
-  if (resolved !== baseResolved && !resolved.startsWith(baseResolved + sep)) {
+  if (!isInside(resolved, baseResolved)) {
     throw new PathTraversalError(`symlink ${path}`, resolved);
   }
 }