Function getUnsafePackageFileReason

packages/cli-exec/src/safety.ts:132–156

(
  packageDirectory: string,
  filePath: string
)

 * Validates that package file ancestors and the file itself are safe.
 */
export async function getUnsafePackageFileReason(
  packageDirectory: string,
  filePath: string
): Promise<string | null> {
  const directoriesToCheck = getDirectoriesBetween(
    packageDirectory,
    path.dirname(filePath)
  );

  if (directoriesToCheck.length === 0) {
    return `${filePath} resolves outside package`;
  }

  for (const directory of directoriesToCheck) {
    const reason = await getUnsafeDirectoryReason(directory);

    if (reason) {
      return `${directory} is ${reason}`;
    }
  }

  const reason = await getUnsafeFileReason(filePath);

  return reason ? `${filePath} is ${reason}` : null;
}

/**
 * Reports unsafe ownership or write permissions for a directory path.