🛡️ Sentinel: [CRITICAL/HIGH] Fix path traversal in manual path resolution

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-27 - Path Traversal in Custom Path Normalization
+**Vulnerability:** Path normalization logic in `typescript.rs` unconditionally called `components.pop()` when encountering a `ParentDir` (`..`).
+**Learning:** This implementation flaw allowed dropping `RootDir` (`/`) or `Prefix` (`C:\`), and mishandled sequential `..` segments when the components list was empty, potentially allowing path resolution outside expected scopes.
+**Prevention:** When manually resolving paths with `std::path::Component`, explicitly check the last component before popping. Ignore `..` if the last element is root/prefix, push `..` if the list is empty or the last element is also `..`, and only pop otherwise.

crates/flow/src/incremental/extractors/typescript.rs

@@ -808,7 +808,17 @@ impl TypeScriptDependencyExtractor {
                 for component in resolved.components() {
                     match component {
                         std::path::Component::ParentDir => {
-                            components.pop();
+                            let last = components.last().copied();
+                            match last {
+                                Some(std::path::Component::RootDir)
+                                | Some(std::path::Component::Prefix(_)) => {}
+                                Some(std::path::Component::ParentDir) | None => {
+                                    components.push(component);
+                                }
+                                _ => {
+                                    components.pop();
+                                }
+                            }
                         }
                         std::path::Component::CurDir => {}
                         _ => components.push(component),