Function checkPathTraversal

src/utils/plugins/validatePlugin.ts:92–106

* Check for parent-directory segments ('..') in a path string. * * For plugin.json component paths this is a security concern (escaping the plugin dir). * For marketplace.json source paths it's almost always a resolution-base misunderstanding: * paths resolve from the marketplace repo root, not

(
  p: string,
  field: string,
  errors: ValidationError[],
  hint?: string,
)

 * to attach the right explanation.
 */
function checkPathTraversal(
  p: string,
  field: string,
  errors: ValidationError[],
  hint?: string,
): void {
  if (p.includes('..')) {
    errors.push({
      path: field,
      message: hint
        ? `Path contains "..": ${p}. ${hint}`
        : `Path contains ".." which could be a path traversal attempt: ${p}`,
    })
  }
}

// Shown when a marketplace plugin source contains '..'. Most users hit this because
// they expect paths to resolve relative to marketplace.json (inside .claude-plugin/),