|
17 | 17 |
|
18 | 18 | import { readFile, stat } from 'node:fs/promises'; |
19 | 19 | import { createRequire } from 'node:module'; |
20 | | -import path from 'node:path'; |
| 20 | +import { dirname, isAbsolute, join, relative, resolve } from 'node:path'; |
21 | 21 | import { z } from 'zod'; |
22 | 22 | import { VERSION } from '../../../utilities/version'; |
23 | | -import { McpToolContext, declareTool } from './tool-registry'; |
| 23 | +import { type McpToolContext, declareTool } from './tool-registry'; |
24 | 24 |
|
25 | 25 | const bestPracticesInputSchema = z.object({ |
26 | 26 | workspacePath: z |
@@ -72,7 +72,7 @@ that **MUST** be followed for any task involving the creation, analysis, or modi |
72 | 72 | * @returns A promise that resolves to the string content of the bundled markdown file. |
73 | 73 | */ |
74 | 74 | async function getBundledBestPractices(): Promise<string> { |
75 | | - return readFile(path.join(__dirname, '..', 'resources', 'best-practices.md'), 'utf-8'); |
| 75 | + return readFile(join(__dirname, '../resources/best-practices.md'), 'utf-8'); |
76 | 76 | } |
77 | 77 |
|
78 | 78 | /** |
@@ -126,14 +126,14 @@ async function getVersionSpecificBestPractices( |
126 | 126 | bestPracticesInfo.format === 'markdown' && |
127 | 127 | typeof bestPracticesInfo.path === 'string' |
128 | 128 | ) { |
129 | | - const packageDirectory = path.dirname(pkgJsonPath); |
130 | | - const guidePath = path.resolve(packageDirectory, bestPracticesInfo.path); |
| 129 | + const packageDirectory = dirname(pkgJsonPath); |
| 130 | + const guidePath = resolve(packageDirectory, bestPracticesInfo.path); |
131 | 131 |
|
132 | 132 | // Ensure the resolved guide path is within the package boundary. |
133 | 133 | // Uses path.relative to create a cross-platform, case-insensitive check. |
134 | 134 | // If the relative path starts with '..' or is absolute, it is a traversal attempt. |
135 | | - const relativePath = path.relative(packageDirectory, guidePath); |
136 | | - if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) { |
| 135 | + const relativePath = relative(packageDirectory, guidePath); |
| 136 | + if (relativePath.startsWith('..') || isAbsolute(relativePath)) { |
137 | 137 | logger.warn( |
138 | 138 | `Detected a potential path traversal attempt in '${pkgJsonPath}'. ` + |
139 | 139 | `The path '${bestPracticesInfo.path}' escapes the package boundary. ` + |
|
0 commit comments