* Validate that a resolved path stays within the plugin directory. * Prevents path traversal attacks via .. or absolute paths.
( pluginPath: string, relativePath: string, )
| 26 | * Prevents path traversal attacks via .. or absolute paths. |
| 27 | */ |
| 28 | function validatePathWithinPlugin( |
| 29 | pluginPath: string, |
| 30 | relativePath: string, |
| 31 | ): string | null { |
| 32 | // Resolve both paths to absolute paths |
| 33 | const resolvedPluginPath = resolve(pluginPath) |
| 34 | const resolvedFilePath = resolve(pluginPath, relativePath) |
| 35 | |
| 36 | // Check if the resolved file path is within the plugin directory |
| 37 | const rel = relative(resolvedPluginPath, resolvedFilePath) |
| 38 | |
| 39 | // If relative path starts with .. or is absolute, it's outside the plugin dir |
| 40 | if (rel.startsWith('..') || resolve(rel) === rel) { |
| 41 | return null |
| 42 | } |
| 43 | |
| 44 | return resolvedFilePath |
| 45 | } |
| 46 | |
| 47 | /** |
| 48 | * Load LSP server configurations from a plugin. |
no test coverage detected