fix: keep lexical containment in open service allowed-root check

Author: antfubot

services/open/src/index.ts

@@ -94,27 +94,26 @@ export function createOpenService(options?: OpenServiceOptions): DevframeService
     // Option sets from multiple installers merge via devframe's default
     // deep-merge: `roots` union, `editor` last-wins.
     setup(ctx, { options }) {
-      // Canonicalize each allowed root once (resolving symlinks in the root
-      // paths themselves) so containment compares canonical to canonical.
-      const allowedRoots = Promise.all(
-        [ctx.workspaceRoot, ...(options?.roots ?? [])].map(r => nearestExistingCanonical(resolve(r))),
-      )
+      const allowedRoots = [ctx.workspaceRoot, ...(options?.roots ?? [])].map(r => resolve(r))
+      // Canonical forms of the same roots (symlinks in the root paths
+      // resolved), computed once for the symlink-aware pass.
+      const canonicalRoots = Promise.all(allowedRoots.map(r => nearestExistingCanonical(r)))
+
+      const within = (roots: string[], p: string): boolean => roots.some((root) => {
+        const rel = relative(root, p)
+        return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel))
+      })
 
       /**
-       * Resolve `path` (relative paths against `workspaceRoot`) and assert
-       * its canonical location lands inside one of the allowed roots, or
-       * throw. Canonicalizing the nearest existing ancestor rejects a symlink
-       * that would redirect the open outside every allowed root, while still
+       * Resolve `path` (relative paths against `workspaceRoot`) and assert it
+       * lands inside one of the allowed roots, or throw. The lexical pass
+       * rejects plain `..`/absolute escapes; the canonical pass rejects a
+       * symlink that would redirect the open outside every root, while still
        * allowing not-yet-existing files under a root.
        */
       async function assertAllowedPath(path: string): Promise<string> {
         const resolved = isAbsolute(path) ? resolve(path) : resolve(ctx.workspaceRoot, path)
-        const canonical = await nearestExistingCanonical(resolved)
-        const contained = (await allowedRoots).some((root) => {
-          const rel = relative(root, canonical)
-          return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel))
-        })
-        if (!contained)
+        if (!within(allowedRoots, resolved) || !within(await canonicalRoots, await nearestExistingCanonical(resolved)))
           throw diagnostics.DS_OPEN_0002({ path })
         return resolved
       }