Function getUnsafePackageDirectoryReason

packages/cli-exec/src/safety.ts:105–127

(
  nodeModulesDirectory: string,
  packageDirectory: string
)

 * Validates that each package directory segment is safe and under node_modules.
 */
export async function getUnsafePackageDirectoryReason(
  nodeModulesDirectory: string,
  packageDirectory: string
): Promise<string | null> {
  const directoriesToCheck = getDirectoriesBetween(
    nodeModulesDirectory,
    packageDirectory
  );

  if (directoriesToCheck.length === 0) {
    return `${packageDirectory} resolves outside local node_modules`;
  }

  for (const directory of directoriesToCheck) {
    const reason = await getUnsafeDirectoryReason(directory);

    if (reason) {
      return `${directory} is ${reason}`;
    }
  }

  return null;
}

/**
 * Validates that package file ancestors and the file itself are safe.