Function assertRealpathInWorktree

src/main/lib/git/security/secure-fs.ts:178–210

* Check if the resolved realpath stays within the worktree boundary. * Prevents symlink escape attacks where a symlink points outside the worktree. * * @throws PathValidationError if realpath escapes worktree

(
	worktreePath: string,
	fullPath: string,
)

 * @throws PathValidationError if realpath escapes worktree
 */
async function assertRealpathInWorktree(
	worktreePath: string,
	fullPath: string,
): Promise<void> {
	try {
		const real = await realpath(fullPath);
		const worktreeReal = await realpath(worktreePath);

		// Use path.relative for safer boundary checking
		if (!isPathWithinWorktree(worktreeReal, real)) {
			throw new PathValidationError(
				"File is a symlink pointing outside the worktree",
				"SYMLINK_ESCAPE",
			);
		}
	} catch (error) {
		// If realpath fails with ENOENT, the target doesn't exist
		// But the path itself might be a dangling symlink - check that first!
		if (error instanceof Error && "code" in error && error.code === "ENOENT") {
			await assertDanglingSymlinkSafe(worktreePath, fullPath);
			return;
		}
		// Re-throw PathValidationError
		if (error instanceof PathValidationError) {
			throw error;
		}
		// Other errors (permission denied, etc.) - fail closed for security
		throw new PathValidationError(
			"Cannot validate file path",
			"SYMLINK_ESCAPE",
		);
	}
}

/**
 * Handle the ENOENT case: check if fullPath is a dangling symlink pointing outside