🛡️ Sentinel: [HIGH] Fix Path Traversal in TypeScript Extractor

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-24 - [Path Traversal in Manual Path Resolution]
+**Vulnerability:** Path traversal via manual `..` (ParentDir) path normalization blindly popping the last component without checking if it's the root directory or if the path is already empty.
+**Learning:** `std::path::PathBuf::components()` lexical resolution requires explicit handling of `Component::ParentDir` to avoid popping `Component::RootDir` or losing preceding `..` directives when resolving relative paths that point outside the base directory.
+**Prevention:** Always check `components.last()` when popping. If it's a `RootDir` or `Prefix`, do not pop. If the stack is empty or the last item is also `ParentDir`, push the `ParentDir` component instead of ignoring it.

crates/flow/src/incremental/extractors/typescript.rs

@@ -808,7 +808,24 @@ impl TypeScriptDependencyExtractor {
                 for component in resolved.components() {
                     match component {
                         std::path::Component::ParentDir => {
-                            components.pop();
+                            // SECURITY: Prevent path traversal by preserving ParentDir
+                            // at the root or when preceding components are also ParentDir,
+                            // and avoiding popping RootDir/Prefix.
+                            let is_root = matches!(
+                                components.last(),
+                                Some(std::path::Component::RootDir | std::path::Component::Prefix(_))
+                            );
+                            let is_parent = matches!(
+                                components.last(),
+                                Some(std::path::Component::ParentDir)
+                            );
+                            let is_empty = components.is_empty();
+
+                            if is_empty || is_parent {
+                                components.push(component);
+                            } else if !is_root {
+                                components.pop();
+                            }
                         }
                         std::path::Component::CurDir => {}
                         _ => components.push(component),