feat(release): reject unsafe override values in VendoredFileChecker

Reject overrides that are absolute or contain `..` segments — overrides
must resolve inside the consumer dir. Defense-in-depth against a typo or
malicious override that escapes the intended consumer layout.

Assisted-by: Claude Code

Author: kojiromike

tools/release/src/VendoredFileChecker.php

@@ -49,21 +49,30 @@
     /**
      * @param array<string, string> $pathOverrides Map of canonical relative
      *     path → consumer relative path. Unmapped entries default to the
-     *     canonical path. Unknown keys (not in VENDORED_PATHS) throw.
+     *     canonical path. Unknown keys (not in VENDORED_PATHS) throw, as do
+     *     values that are absolute or contain `..` segments — overrides must
+     *     stay inside the consumer dir.
      */
     public function __construct(
         private string $canonicalRoot,
         private string $consumerDir,
         private array $pathOverrides = [],
     ) {
-        foreach (array_keys($pathOverrides) as $key) {
+        foreach ($pathOverrides as $key => $value) {
             if (!in_array($key, self::VENDORED_PATHS, true)) {
                 throw new \InvalidArgumentException(sprintf(
                     'Unknown override key %s; must be one of: %s',
                     $key,
                     implode(', ', self::VENDORED_PATHS),
                 ));
             }
+            if ($value === '' || $value[0] === '/' || preg_match('#(^|/)\.\.(/|$)#', $value) === 1) {
+                throw new \InvalidArgumentException(sprintf(
+                    'Override value for %s must be a relative path inside the consumer dir, got: %s',
+                    $key,
+                    $value,
+                ));
+            }
         }
     }
 

tools/release/tests/VendoredFileCheckerTest.php

@@ -14,6 +14,7 @@
 
 use OpenEMR\Release\VendoredDriftIssue;
 use OpenEMR\Release\VendoredFileChecker;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\TestCase;
 
 final class VendoredFileCheckerTest extends TestCase
@@ -269,6 +270,30 @@ public function testUnknownOverrideKeyThrows(): void
         );
     }
 
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function unsafeOverrideValueProvider(): iterable
+    {
+        yield 'absolute path' => ['/etc/passwd'];
+        yield 'parent traversal' => ['../outside.php'];
+        yield 'embedded parent traversal' => ['src/../../outside.php'];
+        yield 'trailing parent traversal' => ['src/Release/..'];
+        yield 'empty value' => [''];
+    }
+
+    #[DataProvider('unsafeOverrideValueProvider')]
+    public function testUnsafeOverrideValueThrows(string $unsafeValue): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        new VendoredFileChecker(
+            $this->canonicalRoot,
+            $this->consumerDir,
+            ['src/TagVerifier.php' => $unsafeValue],
+        );
+    }
+
     /**
      * @param list<string>|null $only restrict which paths to write
      */