mirror of
https://github.com/pnpm/pnpm.git
synced 2026-05-29 19:20:04 -04:00
2067a86e02
Backport of #11954 to release/10. A transitive registry package can use a dependency-alias key like `@x/../../../../../.git/hooks` to make `pnpm install` create a symlink outside the intended `node_modules` directory, since pnpm passes the alias straight into `path.join(modulesDir, alias)` without checking that the joined path stays inside `modulesDir`. Reject aliases that aren't a valid npm package name at manifest-read time (both the importer's manifest and every transitive package manifest) and re-check at the symlink layer as defense in depth, via a single `safeJoinModulesDir` that throws on escape. --- Written by an agent (Claude Code, claude-opus-4-7).