🛡️ Sentinel: [HIGH] Fix path traversal in manual path normalization

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-06-11 - [Path Traversal] Improper Manual Path Normalization in TypeScript Extractor
+**Vulnerability:** A path traversal vulnerability existed in `crates/flow/src/incremental/extractors/typescript.rs` during manual module path resolution fallback. When resolving `../` components using `std::path::Component::ParentDir`, the code unconditionally popped the last component from the constructed path. This allowed `../` components to pop root directories (`Component::RootDir`), prefixes (`Component::Prefix`), or ignore leading `../` sequences, potentially leading to unauthorized path traversal and incorrect relative path construction.
+**Learning:** Manual path normalization is error-prone. In Rust's `std::path::Component` iteration, `Component::ParentDir` must be handled contextually. It should never pop root or prefix components, and if a path starts with `ParentDir` (or only contains `ParentDir`s so far), the `ParentDir` must be explicitly pushed onto the stack to preserve relative navigation, rather than ignored or attempting to pop an empty list.
+**Prevention:** When performing manual path component normalization, always match on the last pushed component type. Explicitly block `Component::ParentDir` from popping `RootDir` or `Prefix`, and ensure it is pushed when the list is empty or the last item is also a `ParentDir`.

crates/flow/src/incremental/extractors/typescript.rs

@@ -808,7 +808,18 @@ impl TypeScriptDependencyExtractor {
                 for component in resolved.components() {
                     match component {
                         std::path::Component::ParentDir => {
-                            components.pop();
+                            if let Some(last) = components.last() {
+                                match last {
+                                    std::path::Component::ParentDir => components.push(component),
+                                    std::path::Component::Normal(_) => {
+                                        components.pop();
+                                    }
+                                    // Do not pop RootDir or Prefix
+                                    _ => {}
+                                }
+                            } else {
+                                components.push(component);
+                            }
                         }
                         std::path::Component::CurDir => {}
                         _ => components.push(component),