Function resolveSafeChildPath

packages/core/src/tools/scaffold.ts:137–158

(root: string, relPath: string)

}

async function resolveSafeChildPath(root: string, relPath: string): Promise<string> {
  const absRoot = path.resolve(root);
  const absPath = resolveChildPath(absRoot, relPath);
  const rel = path.relative(absRoot, absPath);
  if (rel.length === 0) return absPath;

  const parts = rel.split(path.sep).filter((part) => part.length > 0);
  let cursor = absRoot;
  for (const part of parts) {
    cursor = path.join(cursor, part);
    try {
      const entry = await lstat(cursor);
      if (entry.isSymbolicLink()) {
        throw new Error(`path traverses symbolic link: ${path.relative(absRoot, cursor)}`);
      }
    } catch (err) {
      if ((err as NodeJS.ErrnoException).code === 'ENOENT') break;
      throw err;
    }
  }
  return absPath;
}

export interface ScaffoldRequest {
  kind: string;