@theokit/sdk 4.19.3 → 4.20.0

package/dist/eval.cjs

@@ -850,6 +850,11 @@ var init_atomic_write = __esm({
     warnedNfsDirs = /* @__PURE__ */ new Set();
   }
 });
+function isInside(target, base) {
+  if (target === base) return true;
+  const prefix = base.endsWith(path.sep) ? base : base + path.sep;
+  return target.startsWith(prefix);
+}
 function safePathJoin(base, ...parts) {
   if (base === "") {
     throw new Error("safePathJoin: base must be non-empty");
@@ -860,8 +865,7 @@ function safePathJoin(base, ...parts) {
   }
   const baseResolved = path.resolve(base);
   const target = path.resolve(base, ...parts);
-  const prefix = baseResolved.endsWith(path.sep) ? baseResolved : baseResolved + path.sep;
-  if (target !== baseResolved && !target.startsWith(prefix)) {
+  if (!isInside(target, baseResolved)) {
     throw new PathTraversalError(parts.join("/"), target);
   }
   return target;
@@ -886,7 +890,7 @@ function assertNoSymlinkEscape(path$1, base) {
   }
   const resolved = realpathOfDeepestExisting(path$1);
   if (resolved === void 0) return;
-  if (resolved !== baseResolved && !resolved.startsWith(baseResolved + path.sep)) {
+  if (!isInside(resolved, baseResolved)) {
     throw new PathTraversalError(`symlink ${path$1}`, resolved);
   }
 }