Function checkPath

packages/angular/cli/src/commands/mcp/host.ts:291–330

(path: string)

  let roots = initialRoots;

  function checkPath(path: string) {
    const resolvedPath = resolve(path);
    let realPath: string;
    try {
      realPath = realpathSync(resolvedPath);
    } catch (e) {
      if ((e as Error & { code?: string }).code === 'ENOENT') {
        // Path does not exist. Find the first existing ancestor.
        let current = resolvedPath;
        while (current) {
          try {
            realPath = realpathSync(current);
            break;
          } catch (err) {
            if ((err as Error & { code?: string }).code !== 'ENOENT') {
              throw err;
            }
            const parent = dirname(current);
            if (parent === current) {
              // Reached filesystem root
              throw err;
            }
            current = parent;
          }
        }
      } else {
        throw e;
      }
    }

    const isAllowed = roots.some((root) => {
      const rel = relative(root, realPath);

      return !rel.startsWith('..') && !isAbsolute(rel);
    });

    if (!isAllowed) {
      throw new Error(`Access denied: path '${path}' is outside allowed roots.`);
    }
  }

  return {
    ...baseHost,