From b60fed3da35393745fddff367228bf0a0e5c1315 Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 01:13:52 +0000
Subject: [PATCH] fix(security): autofix Potential file inclusion attack via
 reading file

---
 packages/tron-lib/src/helpers/loadForgeArtifact.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/packages/tron-lib/src/helpers/loadForgeArtifact.ts b/packages/tron-lib/src/helpers/loadForgeArtifact.ts
index 789ab04..f5eb2d4 100644
--- a/packages/tron-lib/src/helpers/loadForgeArtifact.ts
+++ b/packages/tron-lib/src/helpers/loadForgeArtifact.ts
@@ -1,5 +1,5 @@
 import { readFile } from 'fs/promises'
-import { resolve } from 'path'
+import { resolve, relative } from 'path'
 
 import { consola } from 'consola'
 
@@ -14,10 +14,15 @@ export async function loadForgeArtifact(
   contractName: string,
   artifactsDir: string = resolve(process.cwd(), 'out')
 ): Promise<IForgeArtifact> {
+  const baseDir = resolve(artifactsDir)
   const artifactPath = resolve(
-    artifactsDir,
+    baseDir,
     `${contractName}.sol/${contractName}.json`
   )
+  const rel = relative(baseDir, artifactPath)
+  if (rel.startsWith('..') || resolve(rel) === rel) {
+    throw new Error(`Invalid contract name: ${contractName}`)
+  }
 
   try {
     const artifact = JSON.parse(await readFile(artifactPath, 'utf-8'))