mirror of
https://github.com/Kong/insomnia.git
synced 2026-08-03 03:15:06 -04:00
traversePluginPath's containment check was purely lexical, so a plugin folder that was itself a symlink to somewhere outside the configured plugin path passed it and got require()'d from its real target with the sandbox off. Re-check against the realpath-resolved base.