Skip to content

Copilot/sub pr 8 another one #48

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
toolate28 merged 3 commits into from
Jan 18, 2026
Merged

Copilot/sub pr 8 another one #48

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cc744f5
Initial plan
Copilot Jan 16, 2026
ae14e87
Fix path traversal vulnerability in setup.ts
Copilot Jan 16, 2026
6976e7b
Merge branch 'main' into copilot/sub-pr-8-another-one
toolate28 Jan 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 5 additions & 12 deletions scripts/setup.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,18 +102,11 @@ async function installDependencies(force: boolean): Promise<boolean> {
const nodeModulesPath = join(ROOT_DIR, "node_modules");
if (force) {
log("step", "Force reinstalling dependencies...");
// Validate path before removal for security
// Ensure the resolved path is within the project directory
const resolvedNodeModules = resolve(nodeModulesPath);
const resolvedRoot = resolve(ROOT_DIR);
const expectedPath = resolve(resolvedRoot, "node_modules");

// Check that the resolved path exactly matches the expected node_modules path
// This prevents path traversal attacks (e.g., /etc/node_modules)
const isValidPath = resolvedNodeModules === expectedPath;

if (existsSync(nodeModulesPath) && isValidPath) {
rmSync(nodeModulesPath, { recursive: true, force: true });
// Validate path before removal for safety - ensure it resolves to expected location
const resolvedPath = resolve(nodeModulesPath);
Comment on lines +105 to +106
Copy link

Copilot AI Jan 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comparison between resolvedPath and expectedPath is redundant. Since nodeModulesPath is already defined as join(ROOT_DIR, "node_modules") on line 101, calling resolve(nodeModulesPath) and resolve(ROOT_DIR, "node_modules") will always produce identical results. Both expressions are computing the same absolute path from the same inputs.

A more meaningful safety check would validate that the resolved path is within the project directory or matches a specific pattern, rather than comparing two computations of the same value.

Copilot uses AI. Check for mistakes.
Copy link
Owner Author

@toolate28 toolate28 Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback

const expectedPath = resolve(ROOT_DIR, "node_modules");
if (existsSync(resolvedPath) && resolvedPath === expectedPath) {
rmSync(resolvedPath, { recursive: true, force: true });
}
await $`cd ${ROOT_DIR} && bun install`.quiet();
} else {
Expand Down
Loading