fix(core): prevent symlink path traversal in htmlBundler safePath (F-005)

[vanceingalls]

Summary

• Adds isSymlinkWithinProject(resolved, projectDir): calls realpathSync() on both the candidate path and the project root, then re-verifies that the real path starts with the real base.
• safePath calls it after the existing lexical startsWith check.
• safeReadFile gains an optional projectDir parameter; when supplied it runs the same check before reading. Used by the @import resolution path in inlineCssFile, which bypasses safePath and reads the imported file directly.
• Both attack vectors are covered by new vitest tests that plant a symlink inside a temp project dir pointing at a file in a sibling tmpdir.

Security

F-005 MED — safePath used path.resolve() for containment checking, which is purely lexical and does not follow symlinks. A symlink placed inside the project directory pointing at a file outside it (e.g. /etc/passwd, a secrets file) would pass the startsWith(normalizedBase) check and expose the target file's contents in the bundle output. The @import CSS inlining path had the same issue via an inline check that also skipped symlink resolution.

Test plan

• Symlink inside projectDir pointing to a file outside — <link rel="stylesheet"> reference: bundled output does not contain the outside file's content
• Symlink inside projectDir pointing to a file outside — @import reference in an inlined CSS file: bundled output does not contain the outside file's content
• All 36 htmlBundler unit tests pass (including all existing CSS inlining, rebasing, and @import chain tests)

[vanceingalls]

• fix(core): prevent symlink path traversal in htmlBundler safePath (F-005) #1214 👈 (View in Graphite)
• fix(aws-lambda): validate event S3 URIs against render bucket (F-004) #1213
• fix(cli): re-validate SSRF denylist on redirects + harden isPrivateUrl #1212
• fix(cli): bind studio preview server to loopback by default #1210
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[miguel-heygen]

Review: #1214 — prevent symlink path traversal in htmlBundler safePath

Good fix. Notes:

htmlBundler.ts

• isSymlinkWithinProject: uses realpathSync on both the target path and projectDir to resolve all symlinks before comparing. This correctly handles the case where projectDir itself is a symlink. ✓
• catch { return true } — returning true (safe) on any realpathSync error means dangling symlinks are allowed through to safePath where they'll get rejected by existsSync in safeReadFile. Safe but slightly surprising — a comment explaining the rationale (dangling symlink can't be read) would help. The JSDoc on the function already covers this. ✓
• safePath now calls isSymlinkWithinProject after the string-prefix check. Both checks are needed — string prefix catches ../ traversal without symlinks, realpathSync check catches symlinks. ✓
• safeReadFile also gets the projectDir? guard, applied inside inlineCssFile for @import resolution. ✓

Tests

• Direct symlink test (evil.css) and @import-through-symlink test both covered. ✓
• makeSymlinkProject creates the outside dir first, then the project, then the symlink — correct order. ✓
• rmSync in finally block cleans up the outside dir. ✓

One small concern: the isSymlinkWithinProject function is not exported, so it can't be unit-tested directly. The integration tests via bundleToSingleHtml cover the behavior, but a direct unit test would make future refactors safer.

No blocking issues. LGTM.

[miguel-heygen]

LGTM. Nice-to-have: export for direct unit testing, but not blocking.

[miguel-heygen]

LGTM. Nice-to-have: export isSymlinkWithinProject for direct unit testing, but not blocking.

[graphite-app]

Merge activity

• Jun 6, 12:53 AM UTC: This pull request can not be added to the Graphite merge queue. Please try rebasing and resubmitting to merge when ready.
• Jun 6, 12:53 AM UTC: Graphite disabled "merge when ready" on this PR due to: a merge conflict with the target branch; resolve the conflict and try again..