security(cli): suppress false-positive path-traversal Semgrep findings on the path-containment guard (APS-19008)

semgrep/ci blocked #1141 on 4 path-join-resolve-traversal findings, all on the
new path-CONTAINMENT code itself: isPathInsideBase() (securityValidation.js:61-62)
and validateBstackJson's resolve (utils.js:42). The path.resolve() calls ARE the
anti-traversal guard — each is immediately followed by a containment check
(startsWith(base+sep) / isPathInsideBase + .json-extension). Semgrep flags
resolve(userInput) without seeing the guard, so these are false positives.

Added // nosemgrep on the exact lines with justification (per Security Ops book #68).
No behaviour change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Rohannagariya1

bin/helpers/securityValidation.js

@@ -58,7 +58,9 @@ function isPathInsideBase(candidatePath, baseDir) {
   if (typeof candidatePath !== 'string' || candidatePath === '') {
     return false;
   }
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- these resolves ARE the traversal guard: the value is normalized here only so the containment check below can reject anything outside `base`.
   const base = path.resolve(baseDir || process.cwd());
+  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- see above; resolved path is validated by the startsWith(base) check, not used to read the FS unchecked.
   const resolved = path.resolve(base, candidatePath);
   // Must be the base itself or a descendant (base + separator prefix).
   return resolved === base || resolved.startsWith(base + path.sep);

bin/helpers/utils.js

@@ -39,6 +39,7 @@ exports.validateBstackJson = (bsConfigPath) => {
       // PR-supplied .js config would run arbitrary code, APS-19008). Also require
       // a .json extension and that the file resolves inside the project root so a
       // crafted --config-file cannot point outside the project or at a script.
+      // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal -- this resolve IS the traversal guard: the path is normalized here so the .json-extension + isPathInsideBase() containment checks below can reject anything outside the project root.
       const resolvedPath = path.resolve(bsConfigPath);
       if (path.extname(resolvedPath).toLowerCase() !== ".json") {
         return reject(`Invalid browserstack.json file. Error : config file must be a .json file.`);