Merge branch 'trunk' into stu-1971-in-app-browser-preview-may-keep-url-path-when-switching

Author: sejas

apps/local/src/index.ts

@@ -34,6 +34,7 @@ import {
 import {
 	arePathsEqual,
 	isEmptyDir,
+	isPathWithin,
 	isWordPressDirectory,
 	recursiveCopyDirectory,
 } from '@studio/common/lib/fs-utils';
@@ -525,7 +526,15 @@ export async function startLocalServer( options: LocalServerOptions ): Promise<
 
 	api.post( '/paths/compare', ( req: Request, res: Response ) => {
 		const { path1, path2 } = req.body as { path1?: string; path2?: string };
-		res.json( { equal: !! path1 && !! path2 && arePathsEqual( path1, path2 ) } );
+		// Confine both operands to `sitesRoot`: nothing outside it can be a site, and
+		// this keeps untrusted input from reaching statSync (in arePathsEqual).
+		const equal =
+			!! path1 &&
+			!! path2 &&
+			isPathWithin( sitesRoot, path1 ) &&
+			isPathWithin( sitesRoot, path2 ) &&
+			arePathsEqual( path1, path2 );
+		res.json( { equal } );
 	} );
 
 	api.post(