Fix paths asset regression

internal/pipeline/extract.go

@@ -156,10 +156,15 @@ func extractArchiveResources(p *project.Project, archive erf.Archive, desired ma
 
 func extractedFile(p *project.Project, resource erf.Resource, extension string) (string, []byte, error) {
 	resref := strings.ToLower(resource.Name)
+	effective := p.EffectiveConfig()
 
 	switch extension {
 	case "nss":
-		return filepath.Join(p.ScriptSourceDir(), resref+".nss"), resource.Data, nil
+		target, err := extractionTarget(p, "paths.source", effective.Paths.Source, p.SourceDir(), filepath.FromSlash(effective.Scripts.SourceDir), resref+".nss")
+		if err != nil {
+			return "", nil, err
+		}
+		return target, resource.Data, nil
 	case "utc", "utd", "ute", "uti", "utm", "utp", "uts", "utt", "utw",
 		"are", "dlg", "fac", "gic", "git", "ifo", "itp", "jrl":
 		document, err := gff.Read(bytes.NewReader(resource.Data))
@@ -171,12 +176,41 @@ func extractedFile(p *project.Project, resource erf.Resource, extension string)
 			return "", nil, fmt.Errorf("marshal json %s.%s: %w", resource.Name, extension, err)
 		}
 		formatted = append(formatted, '\n')
-		return filepath.Join(p.SourceDir(), sourceSubdir(extension), resref+"."+extension+".json"), formatted, nil
+		target, err := extractionTarget(p, "paths.source", effective.Paths.Source, p.SourceDir(), sourceSubdir(extension), resref+"."+extension+".json")
+		if err != nil {
+			return "", nil, err
+		}
+		return target, formatted, nil
 	default:
-		return filepath.Join(p.AssetsDir(), extension, resref+"."+extension), resource.Data, nil
+		target, err := extractionTarget(p, "paths.assets", effective.Paths.Assets, p.AssetsDir(), extension, resref+"."+extension)
+		if err != nil {
+			return "", nil, err
+		}
+		return target, resource.Data, nil
 	}
 }
 
+func extractionTarget(p *project.Project, field, configured, root string, parts ...string) (string, error) {
+	if strings.TrimSpace(configured) == "" {
+		return "", fmt.Errorf("cannot extract resource: %s is not configured", field)
+	}
+
+	cleanRoot := filepath.Clean(root)
+	if cleanRoot == "." || cleanRoot == string(filepath.Separator) || cleanRoot == filepath.Clean(p.Root) {
+		return "", fmt.Errorf("cannot extract resource: %s resolves to unsafe extraction root %s", field, cleanRoot)
+	}
+
+	target := filepath.Join(append([]string{cleanRoot}, parts...)...)
+	rel, err := filepath.Rel(cleanRoot, target)
+	if err != nil {
+		return "", fmt.Errorf("resolve extraction target %s: %w", target, err)
+	}
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
+		return "", fmt.Errorf("refusing to extract resource outside %s: %s", cleanRoot, target)
+	}
+	return target, nil
+}
+
 func extractHAKPaths(p *project.Project) ([]string, error) {
 	switch p.EffectiveConfig().Extract.HAKDiscovery {
 	case "configured_haks":
@@ -236,14 +270,18 @@ func writeManagedFile(path string, data []byte) (writeState, error) {
 
 func cleanupStaleFiles(p *project.Project, desired map[string]struct{}) (int, []error) {
 	candidates := make([]string, 0, len(p.Inventory.SourceFiles)+len(p.Inventory.ScriptFiles)+len(p.Inventory.AssetFiles))
-	for _, rel := range p.Inventory.SourceFiles {
-		candidates = append(candidates, filepath.Join(p.SourceDir(), filepath.FromSlash(rel)))
+	if safeCleanupRoot(p.SourceDir(), p.Root) {
+		for _, rel := range p.Inventory.SourceFiles {
+			candidates = append(candidates, filepath.Join(p.SourceDir(), filepath.FromSlash(rel)))
+		}
+		for _, rel := range p.Inventory.ScriptFiles {
+			candidates = append(candidates, filepath.Join(p.SourceDir(), filepath.FromSlash(rel)))
+		}
 	}
-	for _, rel := range p.Inventory.ScriptFiles {
-		candidates = append(candidates, filepath.Join(p.SourceDir(), filepath.FromSlash(rel)))
-	}
-	for _, rel := range p.Inventory.AssetFiles {
-		candidates = append(candidates, filepath.Join(p.AssetsDir(), filepath.FromSlash(rel)))
+	if safeCleanupRoot(p.AssetsDir(), p.Root) {
+		for _, rel := range p.Inventory.AssetFiles {
+			candidates = append(candidates, filepath.Join(p.AssetsDir(), filepath.FromSlash(rel)))
+		}
 	}
 
 	removed := 0
@@ -266,6 +304,11 @@ func cleanupStaleFiles(p *project.Project, desired map[string]struct{}) (int, []
 	return removed, failures
 }
 
+func safeCleanupRoot(root, projectRoot string) bool {
+	cleanRoot := filepath.Clean(root)
+	return cleanRoot != "." && cleanRoot != string(filepath.Separator) && cleanRoot != filepath.Clean(projectRoot)
+}
+
 func cleanupEmptyParents(dir string, roots ...string) {
 	for {
 		if dir == "." || dir == string(filepath.Separator) {