Function isPathWithinWorktree

src/main/lib/git/security/secure-fs.ts:34–54

* Check if a resolved path is within the worktree boundary using path.relative(). * This is safer than string prefix matching which can have boundary bugs.

(
	worktreeReal: string,
	targetReal: string,
)

 * This is safer than string prefix matching which can have boundary bugs.
 */
function isPathWithinWorktree(
	worktreeReal: string,
	targetReal: string,
): boolean {
	if (targetReal === worktreeReal) {
		return true;
	}
	const relativePath = relative(worktreeReal, targetReal);
	// Check if path escapes worktree:
	// - ".." means direct parent
	// - "../" prefix means ancestor escape (use sep for cross-platform)
	// - Absolute path means completely outside
	// Note: Don't use startsWith("..") as it incorrectly catches "..config" directories
	// Note: Empty relativePath ("") case is already handled by the equality check above
	const escapesWorktree =
		relativePath === ".." ||
		relativePath.startsWith(`..${sep}`) ||
		isAbsolute(relativePath);

	return !escapesWorktree;
}

/**
 * Validate that the parent directory chain stays within the worktree.