fix: prevent path traversal in remote file synchronization

[g0w6y]

This PR fixes a critical path traversal vulnerability in the fetchRemote method of the Files class. Previously, remote filenames containing traversal sequences (e.g., ../../) were resolved without validation, allowing files to be written outside the intended project directory.

Changes

Established a Security Boundary: Resolved the absolute path of the contentDir to serve as a "jail" for file operations.

Path Normalization: Used path.resolve to normalize remote filenames and extensions into absolute local paths.

Boundary Validation: Implemented a check to ensure that the resolvedPath starts with the absoluteContentDir followed by the platform-specific path separator.

Security Error Handling: Added logic to throw a Security Error if a file resolution attempt falls outside the project directory, halting potentially malicious write operations.

Impact This fix prevents an attacker with control over a remote Apps Script project from performing arbitrary file writes on a user's local machine during a clasp pull or clasp clone. This effectively neutralizes a potential Remote Code Execution (RCE) vector.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[g0w6y]

Any Update ?

[sqrrrl]

Appreciate the fix, just need the CLA signed

[sqrrrl]

This still allows some paths outside the content dir. The path won't have the trailing /, small edge cases where a parallel dirs share the same prefix.

/foo/bar - content dir
/foo/bar1 - not content dir

../bar1/file.js would resolve to /foo/bar1/file.js, which would pass the startsWith '/foo/bar' check.

Tighter check:

function isParent(parentPath, childPath) {
  const relative = path.relative(parentPath, childPath);
  return relative && !relative.startsWith('..') && !path.isAbsolute(relative);
}

[sqrrrl]

Suggest tightening up the check. It's mostly good, just a small edge case it misses.