{"record":{"id":"6a27098db682c7ac","repo":"diegosouzapw/OmniRoute","slug":"plugin-manifest-main-resolves-outside-plugin-direc","errorCode":null,"errorMessage":"Plugin manifest.main resolves outside plugin directory: \"${ep}\" escapes \"${root}\"","messagePattern":"Plugin manifest\\.main resolves outside plugin directory: \"(.+?)\" escapes \"(.+?)\"","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/plugins/manager.ts","lineNumber":99,"sourceCode":"    throw new Error(\n      `Refusing to delete a path outside the plugin directory: \"${t}\" is not under \"${root}\"`\n    );\n  }\n}\n\n// ── SECURITY: CRITICAL-3 (shared) ──────────────────────────────────────────\n/**\n * Assert that `entryPoint` is strictly within `destDir`.\n * Called at install/upgrade time to reject `manifest.main` values like\n * `\"../../evil.js\"` before the plugin is ever persisted to DB.\n *\n * Throws if the resolved entryPoint escapes `destDir`.\n */\nfunction assertEntryPointWithinDest(destDir: string, entryPoint: string): void {\n  const root = resolve(destDir);\n  const ep = resolve(entryPoint);\n  if (!ep.startsWith(root + sep)) {\n    throw new Error(\n      `Plugin manifest.main resolves outside plugin directory: \"${ep}\" escapes \"${root}\"`\n    );\n  }\n}\n\nclass PluginManager {\n  private static instance: PluginManager;\n  private loadedPlugins: Map<string, LoadedPlugin> = new Map();\n  private pluginDir: string;\n\n  private constructor() {\n    this.pluginDir = getDefaultPluginDir();\n  }\n\n  static getInstance(): PluginManager {\n    if (!PluginManager.instance) {\n      PluginManager.instance = new PluginManager();\n    }","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/plugins/manager.ts#L81-L117","documentation":"Error \"Plugin manifest.main resolves outside plugin directory: \"${ep}\" escapes \"${root}\"\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/lib/plugins/manager.ts:99 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}