{"record":{"id":"71c924ddb3886031","repo":"diegosouzapw/OmniRoute","slug":"plugin-name-entry-point-escapes-plugin-direct","errorCode":null,"errorMessage":"Plugin '${name}' entry point escapes plugin directory","messagePattern":"Plugin '(.+?)' entry point escapes plugin directory","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/plugins/manager.ts","lineNumber":398,"sourceCode":"    // silently enforces nothing while the UI still reports it as active.\n    if (row.status === \"active\" && this.loadedPlugins.has(name)) return;\n\n    const manifest = JSON.parse(row.manifest) as PluginManifestWithDefaults;\n\n    // Path traversal guard: use realpath to resolve symlinks\n    const entryPoint = join(row.pluginDir, manifest.main);\n    let resolvedPluginDir: string;\n    try {\n      resolvedPluginDir = await realpath(row.pluginDir);\n    } catch {\n      throw new Error(`Plugin directory '${row.pluginDir}' does not exist`);\n    }\n    const resolvedEntry = await realpath(entryPoint).catch(() => null);\n    if (\n      !resolvedEntry ||\n      (!resolvedEntry.startsWith(resolvedPluginDir + sep) && resolvedEntry !== resolvedPluginDir)\n    ) {\n      throw new Error(`Plugin '${name}' entry point escapes plugin directory`);\n    }\n\n    try {\n      const loaded = await loadPlugin(entryPoint, manifest);\n\n      const hookNames: LifecycleHookName[] = [\n        \"onRequest\",\n        \"onResponse\",\n        \"onError\",\n        \"onInstall\",\n        \"onActivate\",\n        \"onDeactivate\",\n        \"onUninstall\",\n      ];\n      for (const hookName of hookNames) {\n        const handler = loaded.plugin[hookName];\n        if (typeof handler === \"function\") {\n          registerHook(hookName, name, handler as HookHandler);","sourceCodeStart":380,"sourceCodeEnd":416,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/plugins/manager.ts#L380-L416","documentation":"Error \"Plugin '${name}' entry point escapes plugin directory\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/lib/plugins/manager.ts:398 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}