🛡️ Sentinel: [CRITICAL/HIGH] Fix path traversal in manual path normalization

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-02-27 - [Path Traversal via Manual Path Normalization]
+**Vulnerability:** In `crates/flow/src/incremental/extractors/typescript.rs`, manual path normalization for unresolved module paths naively popped components from the path stack when encountering `ParentDir` (`../`). This allowed popping the `RootDir` or `Prefix`, converting an absolute path into a relative one, or misinterpreting repeated `../` sequences, leading to potential path traversal vulnerabilities.
+**Learning:** `std::path::Component::ParentDir` resolution in Rust requires careful state management. Simply using `components.pop()` fails to account for boundary conditions (like `RootDir` or empty stacks) which are crucial for maintaining the secure scope of file resolutions.
+**Prevention:** Always use the robust component popping pattern: When encountering `ParentDir`, check if the last component in the stack is also `ParentDir`. If it is, or if the stack is empty, push `ParentDir`. Only pop the stack if the last component is a `Normal` directory, and never pop `RootDir` or `Prefix`.

crates/flow/src/incremental/extractors/typescript.rs

@@ -808,7 +808,18 @@ impl TypeScriptDependencyExtractor {
                 for component in resolved.components() {
                     match component {
                         std::path::Component::ParentDir => {
-                            components.pop();
+                            if let Some(c) = components.last() {
+                                if c == &std::path::Component::ParentDir {
+                                    components.push(component);
+                                } else if !matches!(
+                                    c,
+                                    std::path::Component::RootDir | std::path::Component::Prefix(_)
+                                ) {
+                                    components.pop();
+                                }
+                            } else {
+                                components.push(component);
+                            }
                         }
                         std::path::Component::CurDir => {}
                         _ => components.push(component),