Function assertTrustedPath

src/core/parser-shared.ts:23–37

(filePath: string)

 * contain path traversal sequences. Throws if the path is unsafe.
 */
export function assertTrustedPath(filePath: string): void {
  const normalized = path.resolve(filePath);

  // Reject path traversal
  const segments = filePath.replaceAll('\\', '/').split('/');
  if (segments.includes('..')) {
    throw new Error(`Path traversal detected: ${filePath}`);
  }

  const trustedRoots = getTrustedRoots();
  const isTrusted = trustedRoots.some(root => normalized.startsWith(root + path.sep) || normalized === root);
  if (!isTrusted) {
    throw new Error(`Path is outside trusted directories: ${filePath}`);
  }
}

function getTrustedRoots(): string[] {
  const roots: string[] = [];