mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-21 13:12:46 -04:00
Backports three merged security fixes from main to release/10: - Contain hoisted dependency aliases so a crafted lockfile alias cannot escape node_modules or overwrite pnpm-owned layout. The hoisted graph builder now validates each alias at the safeJoinModulesDir sink. (GHSA-fr4h-3cph-29xv, #12343) - Contain pnpm patch-remove deletions to the configured patches directory. (#12341) - Reject path-traversal config dependency names and versions from pnpm-workspace.yaml before they are used to build filesystem paths. (GHSA-qrv3-253h-g69c, #12470) Written by an agent (Claude Code, claude-opus-4-8).
18 lines
491 B
TypeScript
18 lines
491 B
TypeScript
import path from 'path'
|
|
|
|
interface PathUtils {
|
|
isAbsolute: (path: string) => boolean
|
|
relative: (from: string, to: string) => string
|
|
sep: string
|
|
}
|
|
|
|
export function isSubdirectory (parentDir: string, childPath: string, pathUtils: PathUtils = path): boolean {
|
|
const relativePath = pathUtils.relative(parentDir, childPath)
|
|
|
|
return relativePath === '' || (
|
|
relativePath !== '..' &&
|
|
!relativePath.startsWith(`..${pathUtils.sep}`) &&
|
|
!pathUtils.isAbsolute(relativePath)
|
|
)
|
|
}
|