Add canonicalizePath method to resolve relative segments in paths; update related path checks for consistency

Author: rcalicdan

src/Internal/PathMatcher.php

@@ -64,16 +64,52 @@ public static function normalizePath(string|false|null $path): string
         return str_replace('\\', '/', $path);
     }
 
+    /**
+     * Resolves dot-dot (..) relative segments in a path without hitting the disk.
+     */
+    public static function canonicalizePath(string $path): string
+    {
+        $path = str_replace('\\', '/', $path);
+        if (! str_contains($path, '..')) {
+            return $path;
+        }
+
+        $parts = explode('/', $path);
+        $absolutes = [];
+
+        foreach ($parts as $part) {
+            if ($part === '.' || $part === '') {
+                if ($part === '' && empty($absolutes)) {
+                    $absolutes[] = '';
+                }
+                continue;
+            }
+
+            if ($part === '..') {
+                if (! empty($absolutes) && end($absolutes) !== '..') {
+                    array_pop($absolutes);
+                } else {
+                    $absolutes[] = '..';
+                }
+            } else {
+                $absolutes[] = $part;
+            }
+        }
+
+        return implode('/', $absolutes);
+    }
+
     /**
      * Determines whether a given path is located within a vendor directory.
      */
     public static function isVendorPath(string $normalizedPath, string $rawPath = ''): bool
     {
-        $normalizedRaw = self::normalizePath($rawPath);
+        $canon = self::canonicalizePath($normalizedPath);
+        $canonRaw = $rawPath !== '' ? self::canonicalizePath($rawPath) : '';
 
-        return str_starts_with($normalizedPath, 'vendor/')
-            || str_contains($normalizedPath, '/vendor/')
-            || ($normalizedRaw !== '' && (str_starts_with($normalizedRaw, 'vendor/') || str_contains($normalizedRaw, '/vendor/')));
+        return str_starts_with($canon, 'vendor/')
+            || str_contains($canon, '/vendor/')
+            || ($canonRaw !== '' && (str_starts_with($canonRaw, 'vendor/') || str_contains($canonRaw, '/vendor/')));
     }
 
     /**
@@ -160,10 +196,12 @@ public static function hasIncludeMatchingPrefix(string $prefix, array $includes)
      */
     public static function isDynamicWritablePath(string $normalizedPath): bool
     {
-        return str_contains($normalizedPath, '/var/cache/') || str_starts_with($normalizedPath, 'var/cache/')
-            || str_contains($normalizedPath, '/var/log/') || str_starts_with($normalizedPath, 'var/log/')
-            || str_contains($normalizedPath, '/storage/') || str_starts_with($normalizedPath, 'storage/')
-            || str_contains($normalizedPath, '/cache/') || str_starts_with($normalizedPath, 'cache/');
+        $canon = self::canonicalizePath($normalizedPath);
+
+        return str_contains($canon, '/var/cache/') || str_starts_with($canon, 'var/cache/')
+            || str_contains($canon, '/var/log/') || str_starts_with($canon, 'var/log/')
+            || str_contains($canon, '/storage/') || str_starts_with($canon, 'storage/')
+            || str_contains($canon, '/cache/') || str_starts_with($canon, 'cache/');
     }
 
     /**
@@ -172,31 +210,35 @@ public static function isDynamicWritablePath(string $normalizedPath): bool
      */
     public static function mayPathBeIncluded(string $normalizedPath): bool
     {
-        if (str_contains($normalizedPath, '/node_modules/') || str_starts_with($normalizedPath, 'node_modules/')) {
+        $canon = self::canonicalizePath($normalizedPath);
+
+        if (str_contains($canon, '/node_modules/') || str_starts_with($canon, 'node_modules/')) {
             return false;
         }
 
-        if (self::isCachePath($normalizedPath)) {
+        if (self::isCachePath($canon)) {
             return false;
         }
 
         $config = Config::get();
         /** @var array<int, string> $includes */
         $includes = \is_array($config['include'] ?? null) ? $config['include'] : ['**'];
 
-        if (str_contains($normalizedPath, '/vendor/') || str_starts_with($normalizedPath, 'vendor/')) {
+        if (str_contains($canon, '/vendor/') || str_starts_with($canon, 'vendor/')) {
             if (! self::hasIncludeMatchingPrefix('vendor/', $includes)) {
                 return false;
             }
         }
 
-        if (str_contains($normalizedPath, '/var/') || str_starts_with($normalizedPath, 'var/')) {
+        // 4. var/ check: only inspect if user explicitly whitelisted var
+        if (str_contains($canon, '/var/') || str_starts_with($canon, 'var/')) {
             if (! self::hasIncludeMatchingPrefix('var/', $includes)) {
                 return false;
             }
         }
 
-        if (str_contains($normalizedPath, '/storage/') || str_starts_with($normalizedPath, 'storage/')) {
+        // 5. storage/ check: only inspect if user explicitly whitelisted storage
+        if (str_contains($canon, '/storage/') || str_starts_with($canon, 'storage/')) {
             if (! self::hasIncludeMatchingPrefix('storage/', $includes)) {
                 return false;
             }
@@ -241,7 +283,8 @@ public static function isPathIncluded(
         ?string $baseDir = null
     ): bool {
         $baseDir = $baseDir !== null ? self::normalizePath($baseDir) : Config::getProjectRoot();
-        $normalizedRaw = self::normalizePath($rawPath);
+        $normalizedPath = self::canonicalizePath($normalizedPath);
+        $normalizedRaw = $rawPath !== '' ? self::canonicalizePath(self::normalizePath($rawPath)) : '';
 
         $includes = self::getCompiledPatterns($includeGlobs, $baseDir, 'include');
         $excludes = self::getCompiledPatterns($excludeGlobs, $baseDir, 'exclude');
@@ -250,7 +293,8 @@ public static function isPathIncluded(
         if ($isVendor) {
             $hasExplicitVendorWhitelist = false;
             foreach ($includes as $compiled) {
-                if (str_starts_with($compiled['pattern'], 'vendor/') &&
+                if (
+                    str_starts_with($compiled['pattern'], 'vendor/') &&
                     (preg_match($compiled['regex'], $normalizedPath) === 1 || ($normalizedRaw !== '' && preg_match($compiled['regex'], $normalizedRaw) === 1))
                 ) {
                     $hasExplicitVendorWhitelist = true;