Refactor PathMatcher to improve canonicalizePath logic; add comprehensive tests for path resolution scenarios

Author: rcalicdan

src/Internal/PathMatcher.php

@@ -79,14 +79,14 @@ public static function canonicalizePath(string $path): string
 
         foreach ($parts as $part) {
             if ($part === '.' || $part === '') {
-                if ($part === '' && empty($absolutes)) {
+                if ($part === '' && $absolutes === []) {
                     $absolutes[] = '';
                 }
                 continue;
             }
 
             if ($part === '..') {
-                if (! empty($absolutes) && end($absolutes) !== '..') {
+                if ($absolutes !== [] && end($absolutes) !== '..') {
                     array_pop($absolutes);
                 } else {
                     $absolutes[] = '..';
@@ -230,14 +230,12 @@ public static function mayPathBeIncluded(string $normalizedPath): bool
             }
         }
 
-        // 4. var/ check: only inspect if user explicitly whitelisted var
         if (str_contains($canon, '/var/') || str_starts_with($canon, 'var/')) {
             if (! self::hasIncludeMatchingPrefix('var/', $includes)) {
                 return false;
             }
         }
 
-        // 5. storage/ check: only inspect if user explicitly whitelisted storage
         if (str_contains($canon, '/storage/') || str_starts_with($canon, 'storage/')) {
             if (! self::hasIncludeMatchingPrefix('storage/', $includes)) {
                 return false;
@@ -293,8 +291,7 @@ public static function isPathIncluded(
         if ($isVendor) {
             $hasExplicitVendorWhitelist = false;
             foreach ($includes as $compiled) {
-                if (
-                    str_starts_with($compiled['pattern'], 'vendor/') &&
+                if (str_starts_with($compiled['pattern'], 'vendor/') &&
                     (preg_match($compiled['regex'], $normalizedPath) === 1 || ($normalizedRaw !== '' && preg_match($compiled['regex'], $normalizedRaw) === 1))
                 ) {
                     $hasExplicitVendorWhitelist = true;
@@ -371,4 +368,4 @@ private static function getCompiledPatterns(array $globs, string $baseDir, strin
 
         return self::$compiledExcludesCache[$cacheKey] = $compiled;
     }
-}
+}

tests/Internal/PathMatcherTest.php

@@ -38,6 +38,40 @@
         });
     });
 
+    describe('canonicalizePath()', function () {
+        test('resolves relative dot-dot traversals out of vendor directory', function () {
+            $rawComposerPath = 'vendor/composer/../../tests/Fixtures/Generics/Producer.php';
+            expect(PathMatcher::canonicalizePath($rawComposerPath))
+                ->toBe('tests/Fixtures/Generics/Producer.php')
+            ;
+        });
+
+        test('resolves Windows backslash dot-dot traversals', function () {
+            $windowsPath = 'C:\\project\\vendor\\composer\\..\\..\\src\\Service.php';
+            expect(PathMatcher::canonicalizePath($windowsPath))
+                ->toBe('C:/project/src/Service.php')
+            ;
+        });
+
+        test('resolves absolute Unix paths with dot-dot segments', function () {
+            $absolutePath = '/var/www/html/app/../src/Core/Util.php';
+            expect(PathMatcher::canonicalizePath($absolutePath))
+                ->toBe('/var/www/html/src/Core/Util.php')
+            ;
+        });
+
+        test('returns normalized path untouched when no dot-dot segments exist', function () {
+            $cleanPath = 'src/Controller/WebController.php';
+            expect(PathMatcher::canonicalizePath($cleanPath))->toBe($cleanPath);
+        });
+
+        test('handles deep multi-level dot-dot resolution cleanly', function () {
+            expect(PathMatcher::canonicalizePath('a/b/c/d/../../e'))->toBe('a/b/e')
+                ->and(PathMatcher::canonicalizePath('a/b/../../c'))->toBe('c')
+            ;
+        });
+    });
+
     describe('isVendorPath()', function () {
         test('identifies absolute and relative vendor paths correctly', function () {
             expect(PathMatcher::isVendorPath('vendor/doctrine/dbal/src/Schema.php'))->toBeTrue()
@@ -52,6 +86,11 @@
             ;
         });
 
+        test('does not classify relative paths traversing OUT of vendor as vendor paths', function () {
+            $composerRelativeTestPath = 'vendor/composer/../../tests/Fixtures/Generics/Producer.php';
+            expect(PathMatcher::isVendorPath($composerRelativeTestPath))->toBeFalse();
+        });
+
         test('does not falsely classify application directories with vendor prefix as vendor directory', function () {
             expect(PathMatcher::isVendorPath('vendor-tools/Deploy.php'))->toBeFalse()
                 ->and(PathMatcher::isVendorPath('vendor_custom/Helper.php'))->toBeFalse()
@@ -165,6 +204,17 @@
                 ->and(PathMatcher::mayPathBeIncluded('src/App/Controller.php'))->toBeTrue()
             ;
         });
+
+        test('correctly handles relative dot-dot paths traversing out of vendor into included directories', function () {
+            Config::set([
+                'include' => ['src/**', 'tests/**'],
+                'exclude' => ['vendor/**'],
+            ]);
+
+            $traversalPath = 'vendor/composer/../../tests/Fixtures/Generics/Producer.php';
+
+            expect(PathMatcher::mayPathBeIncluded($traversalPath))->toBeTrue();
+        });
     });
 
     describe('compileGlobToRegex()', function () {
@@ -274,4 +324,4 @@
             expect(true)->toBeTrue();
         });
     });
-});
+});