fix: reject path traversal sequences in extras validator (#482)

The extras validator was a no-op and accepted any value. Reject values
containing parent directory references (..),  backslashes, encoded
slashes (%2F) or backslashes (%5C), and protocol-relative prefixes (//),
including multi-level percent-encoded variants.

Author: trygve-lie

lib/validators/extra.js

@@ -1,8 +1,41 @@
 /**
- * No-op, returning its value.
+ * Validates a path extras value, rejecting sequences that could be used
+ * to escape the expected package path via encoded characters.
+ *
+ * Rejects: ".." segments, backslashes (literal or encoded), encoded slashes,
+ * and protocol-relative "//" prefixes.
+ *
  * @param {string} value
  * @returns {string} the value
- * @todo https://github.com/asset-pipe/core/issues/12
- * @todo Can we remove this?
  */
-export const extra = (value) => value;
+export const extra = (value) => {
+	if (!value) return value;
+
+	// Fully decode to catch multi-level percent-encoding (%252F → %2F → /).
+	// Run twice to handle double-encoding; stable after two passes for all
+	// realistic inputs.
+	let once;
+	let twice;
+	try {
+		once = decodeURIComponent(value);
+		twice = decodeURIComponent(once);
+	} catch {
+		throw new Error('Parameter "extra" is not valid');
+	}
+
+	if (
+		twice.includes("..") ||
+		twice.includes("\\") ||
+		twice.includes("//") ||
+		// Reject any remaining encoded slashes or backslashes that survived
+		// after decoding (indicates triple+ encoding or other evasion).
+		twice.includes("%2F") ||
+		twice.includes("%2f") ||
+		twice.includes("%5C") ||
+		twice.includes("%5c")
+	) {
+		throw new Error('Parameter "extra" is not valid');
+	}
+
+	return value;
+};

test/validators/index.test.js

@@ -210,6 +210,42 @@ test(".extra() - valid values - should return value", () => {
 	assert.strictEqual(validators.extra("index.js"), "index.js");
 });
 
+test(".extra() - path traversal with .. - should throw", () => {
+	assert.throws(() => {
+		validators.extra("../../../etc/passwd");
+	}, /Parameter "extra" is not valid/);
+});
+
+test(".extra() - encoded path traversal %2F - should throw", () => {
+	assert.throws(() => {
+		validators.extra("..%2F..%2F..%2Fetc%2Fpasswd");
+	}, /Parameter "extra" is not valid/);
+});
+
+test(".extra() - double-encoded path traversal %252F - should throw", () => {
+	assert.throws(() => {
+		validators.extra("..%252F..%252F..%252F..%252F%255Crmssport.dk");
+	}, /Parameter "extra" is not valid/);
+});
+
+test(".extra() - backslash - should throw", () => {
+	assert.throws(() => {
+		validators.extra("..\\rmssport.dk");
+	}, /Parameter "extra" is not valid/);
+});
+
+test(".extra() - encoded backslash %5C - should throw", () => {
+	assert.throws(() => {
+		validators.extra("..%5Crmssport.dk");
+	}, /Parameter "extra" is not valid/);
+});
+
+test(".extra() - protocol-relative // - should throw", () => {
+	assert.throws(() => {
+		validators.extra("//rmssport.dk");
+	}, /Parameter "extra" is not valid/);
+});
+
 //
 // .semverType()
 //