fix(scan): safely inventory explicitly scoped source files

sdk/typescript/_bundled_plugin/scripts/generate_rank_input.py

@@ -288,10 +288,36 @@ def path_is_excluded(path: Path) -> bool:
     return path.name.endswith((".min.js", ".map"))
 
 
-def resolve_scope(repo: Path, scope: str, *, expand_user: bool = True) -> Path:
+def resolve_scope(
+    repo: Path,
+    scope: str,
+    *,
+    expand_user: bool = True,
+    reject_symlinks: bool = False,
+) -> Path:
     scope_path = Path(scope).expanduser() if expand_user else Path(scope)
     if not scope_path.is_absolute():
         scope_path = repo / scope_path
+    if reject_symlinks:
+        repository = repo.resolve()
+        try:
+            relative = scope_path.relative_to(repository)
+        except ValueError as exc:
+            raise SystemExit(f"Scope must be inside repo: {scope_path}") from exc
+        ancestor = repository
+        for part in relative.parts:
+            if part == "..":
+                if ancestor == repository:
+                    raise SystemExit(f"Scope must be inside repo: {scope_path}")
+                ancestor = ancestor.parent
+                continue
+            ancestor /= part
+            try:
+                metadata = ancestor.stat(follow_symlinks=False)
+            except OSError as exc:
+                raise SystemExit(f"Scope path not found: {ancestor}") from exc
+            if ancestor.is_symlink() or getattr(metadata, "st_reparse_tag", 0) & 0x20000000:
+                raise SystemExit(f"Requested scope must not contain symbolic links: {ancestor}")
     scope_path = scope_path.resolve()
     repo_resolved = repo.resolve()
     try:
@@ -481,7 +507,7 @@ def make_repo_scope_input(args: argparse.Namespace) -> None:
     scopes = load_scopes_file(Path(args.scopes_file).expanduser())
     rows_by_path: dict[str, JsonRow] = {}
     for scope in scopes:
-        scope_path = resolve_scope(repo, scope, expand_user=False)
+        scope_path = resolve_scope(repo, scope, expand_user=False, reject_symlinks=True)
         if scope_path.is_file():
             candidates = (scope_path,)
         else:

sdk/typescript/tests-ts/api.test.ts

@@ -4106,6 +4106,7 @@ describe("CodexSecurity orchestration", () => {
     const repository = join(root, "repository");
     const source = join(repository, "src");
     const ignored = join(source, "node_modules");
+    const vendored = join(source, "vendor");
     const scopes = join(root, "scopes.json");
     const output = join(root, "scoped-source-input.jsonl");
     const interpreter =
@@ -4115,16 +4116,30 @@ describe("CodexSecurity orchestration", () => {
     await mkdir(join(source, "tests"), { recursive: true });
     await mkdir(join(source, "examples"));
     await mkdir(ignored);
+    await mkdir(vendored);
     execFileSync("git", ["init", "-q"], { cwd: repository });
     await Promise.all([
-      writeFile(join(repository, ".gitignore"), "node_modules/\n.env\n"),
+      writeFile(
+        join(repository, ".gitignore"),
+        "node_modules/\n.env\nvendor/\n",
+      ),
       writeFile(join(source, "handler.ts"), "export {};\n"),
       writeFile(join(source, "Dockerfile"), "FROM scratch\n"),
       writeFile(join(source, "tests", "handler.test.ts"), "export {};\n"),
       writeFile(join(source, "examples", "demo.ts"), "export {};\n"),
       writeFile(join(source, ".env"), "SECRET=private\n"),
+      writeFile(
+        join(source, "logo.png"),
+        Buffer.from([0x89, 0x50, 0x4e, 0x47]),
+      ),
       writeFile(join(ignored, "dependency.ts"), "export {};\n"),
+      writeFile(join(vendored, "dependency.ts"), "export {};\n"),
     ]);
+    execFileSync(
+      "git",
+      ["add", "--force", "src/vendor/dependency.ts", "src/logo.png"],
+      { cwd: repository },
+    );
 
     const enumerate = async (requested: string[]) => {
       await writeFile(scopes, JSON.stringify(requested));
@@ -4153,16 +4168,42 @@ describe("CodexSecurity orchestration", () => {
       "src/Dockerfile",
       "src/examples/demo.ts",
       "src/handler.ts",
+      "src/logo.png",
       "src/tests/handler.test.ts",
+      "src/vendor/dependency.ts",
     ]);
     expect(await enumerate(["src", "src/.env"])).toEqual([
       "src/.env",
       "src/Dockerfile",
       "src/examples/demo.ts",
       "src/handler.ts",
+      "src/logo.png",
       "src/tests/handler.test.ts",
+      "src/vendor/dependency.ts",
+    ]);
+    expect(await enumerate(["src/vendor", "src/logo.png"])).toEqual([
+      "src/logo.png",
+      "src/vendor/dependency.ts",
     ]);
     await expect(enumerate(["../scopes.json"])).rejects.toThrow();
+    if (process.platform !== "win32") {
+      await symlink(join(source, "handler.ts"), join(source, "alias.ts"));
+      await symlink(source, join(repository, "alias"));
+      await expect(enumerate(["src/alias.ts"])).rejects.toThrow(
+        /symbolic links/,
+      );
+      await expect(enumerate(["alias/handler.ts"])).rejects.toThrow(
+        /symbolic links/,
+      );
+      await expect(enumerate(["alias/../src/handler.ts"])).rejects.toThrow(
+        /symbolic links/,
+      );
+    } else {
+      await symlink(source, join(repository, "junction"), "junction");
+      await expect(enumerate(["junction/handler.ts"])).rejects.toThrow(
+        /symbolic links/,
+      );
+    }
   });
 
   test("removes scoped target files after a scan settles", async () => {