Function resolveOpenInTarget

packages/shared/html-assets-node.ts:100–130

(
  filePath: string,
  base: string | null,
  resolveRoot?: () => string | string[],
)

 * Returns the absolute path, or null when it escapes every allowed root.
 */
export function resolveOpenInTarget(
  filePath: string,
  base: string | null,
  resolveRoot?: () => string | string[],
): string | null {
  const provided = resolveRoot?.();
  const roots = (
    provided == null
      ? [
          base
            ? resolvePath(base)
            : isAbsolute(filePath)
              ? dirname(resolvePath(filePath))
              : resolvePath(process.cwd()),
        ]
      : Array.isArray(provided)
        ? provided
        : [provided]
  )
    .filter((r): r is string => !!r)
    .map((r) => resolvePath(r));
  // Resolve against each root and return the first that contains its own
  // resolution. For an absolute filePath the resolution is identical for every
  // root (a pure containment check); for a relative filePath this avoids the
  // duplicate-basename trap of resolving only against roots[0].
  for (const root of roots) {
    const abs = resolvePath(root, filePath);
    if (isWithinDirectory(abs, root)) return abs;
  }
  return null;
}