fix: path traversal + vulnerable dependency updates

package.json

@@ -21,7 +21,7 @@
   "dependencies": {
     "commander": "^14.0.3",
     "fast-glob": "^3.3.0",
-    "simple-git": "^3.22.0"
+    "simple-git": "^3.36.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.12",

src/commands/status.ts

@@ -4,7 +4,7 @@ import * as path from 'node:path';
 import fg from 'fast-glob';
 import { getCacheDir } from '../cache';
 import { requireManifest, resolvePath } from '../config';
-import { fileHash, globBase, isGlobPattern } from '../sync';
+import { assertPathWithin, fileHash, globBase, isGlobPattern } from '../sync';
 import type { ManifestEntry, StatusResult } from '../types';
 
 function collectDirectoryEntries(rootDir: string, currentDir: string, entries: string[]): void {
@@ -51,7 +51,6 @@ function stateLabel(state: StatusResult['state']): string {
 
 export function determineState(entry: ManifestEntry): StatusResult['state'] {
   const cacheDir = getCacheDir(entry.repo);
-  const sourcePath = path.join(cacheDir, entry.source);
   const destinationPath = resolvePath(entry.destination);
 
   if (!fs.existsSync(cacheDir)) {
@@ -63,11 +62,26 @@ export function determineState(entry: ManifestEntry): StatusResult['state'] {
     if (!fs.existsSync(cacheDir)) return 'missing';
     const base = globBase(entry.source);
     const absBase = path.join(cacheDir, base);
+    try {
+      assertPathWithin(absBase, cacheDir, `Glob base "${base}"`);
+    } catch {
+      return 'missing';
+    }
     const matches = fg.sync(entry.source, { cwd: cacheDir, absolute: true, onlyFiles: true });
     if (matches.length === 0) return 'missing';
     for (const absMatch of matches) {
+      try {
+        assertPathWithin(absMatch, cacheDir, `Glob match "${absMatch}"`);
+      } catch {
+        return 'missing';
+      }
       const relPath = path.relative(absBase, absMatch);
       const destFile = path.join(destinationPath, relPath);
+      try {
+        assertPathWithin(destFile, destinationPath, `Destination file "${relPath}"`);
+      } catch {
+        return 'missing';
+      }
       if (!fs.existsSync(destFile)) return 'missing';
       const sourceDigest = fileHash(absMatch);
       const destDigest = fileHash(destFile);
@@ -76,6 +90,13 @@ export function determineState(entry: ManifestEntry): StatusResult['state'] {
     return 'current';
   }
 
+  const sourcePath = path.join(cacheDir, entry.source);
+  try {
+    assertPathWithin(sourcePath, cacheDir, `Source path "${entry.source}"`);
+  } catch {
+    return 'missing';
+  }
+
   if (!fs.existsSync(destinationPath)) {
     return 'missing';
   }

src/sync.ts

@@ -5,6 +5,19 @@ import fg from 'fast-glob';
 import { resolvePath } from './config';
 import type { ManifestEntry } from './types';
 
+/**
+ * Throws if `filePath` is not located inside `containingDir`.
+ * Prevents path-traversal attacks where user-controlled values (e.g. entry.source)
+ * could reference files outside the intended directory boundary.
+ */
+export function assertPathWithin(filePath: string, containingDir: string, label: string): void {
+  const resolved = path.resolve(filePath);
+  const base = path.resolve(containingDir);
+  if (resolved !== base && !resolved.startsWith(base + path.sep)) {
+    throw new Error(`${label} escapes the expected directory boundary.`);
+  }
+}
+
 /**
  * Returns SHA-256 hash of file contents, or null if file doesn't exist.
  */
@@ -51,6 +64,7 @@ export async function syncEntry(
   if (isGlobPattern(entry.source)) {
     const base = globBase(entry.source);
     const absBase = path.join(cacheDir, base);
+    assertPathWithin(absBase, cacheDir, `Glob base "${base}"`);
     const matches = fg.sync(entry.source, { cwd: cacheDir, absolute: true, onlyFiles: true });
 
     if (matches.length === 0) {
@@ -60,8 +74,10 @@ export async function syncEntry(
 
     let anyUpdated = false;
     for (const absMatch of matches) {
+      assertPathWithin(absMatch, cacheDir, `Glob match "${absMatch}"`);
       const relPath = path.relative(absBase, absMatch);
       const destFile = path.join(destPath, relPath);
+      assertPathWithin(destFile, destPath, `Destination file "${relPath}"`);
       const sourceDigest = fileHash(absMatch);
       const destDigest = fileHash(destFile);
 
@@ -77,6 +93,7 @@ export async function syncEntry(
   }
 
   const sourcePath = path.join(cacheDir, entry.source);
+  assertPathWithin(sourcePath, cacheDir, `Source path "${entry.source}"`);
 
   let sourceStat: fs.Stats;
   try {