INNER CODE UNIT · JavaScript

assertInsideRoot

agent-sh/agentsys · lib/binary/index.js:350

function assertInsideRoot(root, candidate) {
  const rootResolved = path.resolve(root) + path.sep;
  const candResolved = path.resolve(candidate);
  if (candResolved !== path.resolve(root) && !candResolved.startsWith(rootResolved)) {
    throw new Error('Extracted path escapes extract root: ' + candidate);
  }
}

/**
 * Recursively walk a directory and return all file paths (not dirs).
 * Throws if any symlink is encountered (defense in depth: no surprise escapes).
 * @param {string} dir
 * @returns {string[]}
 */
function walkFiles(dir) {
  const out = [];
  const stack = [dir];
  while (stack.length > 0) {

View source record →