Resolves a tool-supplied path against `repoPath`, rejecting traversal/escape.
(repoPath: string, candidate: string)
| 73 | |
| 74 | /** Resolves a tool-supplied path against `repoPath`, rejecting traversal/escape. */ |
| 75 | function resolveRepoPath(repoPath: string, candidate: string): string { |
| 76 | const clean = sanitizePath(candidate) |
| 77 | const root = repoPath.replace(/\/+$/, '') |
| 78 | if (clean.startsWith('/')) { |
| 79 | if (clean !== root && !clean.startsWith(`${root}/`)) { |
| 80 | throw new Error(`Path is outside the repository: ${candidate}`) |
| 81 | } |
| 82 | return clean |
| 83 | } |
| 84 | return `${root}/${clean}` |
| 85 | } |
| 86 | |
| 87 | function asString(value: unknown): string { |
| 88 | return typeof value === 'string' ? value : '' |
no test coverage detected