{"record":{"id":"ae073a9e93c76722","repo":"diegosouzapw/OmniRoute","slug":"refusing-to-delete-a-path-outside-the-plugin-direc","errorCode":null,"errorMessage":"Refusing to delete a path outside the plugin directory: \"${t}\" is not under \"${root}\"","messagePattern":"Refusing to delete a path outside the plugin directory: \"(.+?)\" is not under \"(.+?)\"","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/plugins/manager.ts","lineNumber":81,"sourceCode":"  const [bMaj, bMin, bPat] = parse(b);\n  if (aMaj !== bMaj) return aMaj - bMaj;\n  if (aMin !== bMin) return aMin - bMin;\n  return aPat - bPat;\n}\n\n// ── SECURITY: CRITICAL-2 ────────────────────────────────────────────────────\n/**\n * Assert that `target` is strictly contained within `pluginRoot`.\n * Prevents a tampered/legacy DB `pluginDir` from causing deletion of an\n * arbitrary filesystem path when passed to `rm({ recursive: true })`.\n *\n * Throws immediately if `target` resolves outside `pluginRoot`.\n */\nfunction assertWithinPluginDir(pluginRoot: string, target: string): void {\n  const root = resolve(pluginRoot);\n  const t = resolve(target);\n  if (t !== root && !t.startsWith(root + sep)) {\n    throw new Error(\n      `Refusing to delete a path outside the plugin directory: \"${t}\" is not under \"${root}\"`\n    );\n  }\n}\n\n// ── SECURITY: CRITICAL-3 (shared) ──────────────────────────────────────────\n/**\n * Assert that `entryPoint` is strictly within `destDir`.\n * Called at install/upgrade time to reject `manifest.main` values like\n * `\"../../evil.js\"` before the plugin is ever persisted to DB.\n *\n * Throws if the resolved entryPoint escapes `destDir`.\n */\nfunction assertEntryPointWithinDest(destDir: string, entryPoint: string): void {\n  const root = resolve(destDir);\n  const ep = resolve(entryPoint);\n  if (!ep.startsWith(root + sep)) {\n    throw new Error(","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/plugins/manager.ts#L63-L99","documentation":"Error \"Refusing to delete a path outside the plugin directory: \"${t}\" is not under \"${root}\"\" thrown in diegosouzapw/OmniRoute.","triggerScenarios":"Thrown at src/lib/plugins/manager.ts:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","schemaVersion":2},"datasetVersion":"2026-08-25T21:54:21.419Z"}