Ensure 'rimraf' can only remove subdirectories of the cwd

lib/commands/instrument.js

@@ -80,7 +80,8 @@ exports.handler = function (argv) {
   })
 
   if (argv.delete && argv.output && argv.output.length !== 0) {
-    if (path.relative(process.cwd(), path.resolve(argv.output)) !== '') {
+    const relPath = path.relative(process.cwd(), path.resolve(argv.output))
+    if (relPath !== '' && !relPath.startsWith('..')) {
       rimraf.sync(argv.output)
     } else {
       console.error(`nyc instrument failed: attempt to delete '${process.cwd()}'`)

test/nyc-integration.js

@@ -784,6 +784,26 @@ describe('the nyc cli', function () {
             done()
           })
         })
+
+        it('aborts if trying to clean outside working directory', function (done) {
+          const args = [bin, 'instrument', '--delete', './', '../']
+
+          const proc = spawn(process.execPath, args, {
+            cwd: fixturesCLI,
+            env: env
+          })
+
+          let stderr = ''
+          proc.stderr.on('data', function (chunk) {
+            stderr += chunk
+          })
+
+          proc.on('close', function (code) {
+            code.should.equal(1)
+            stderr.should.include('nyc instrument failed: attempt to delete')
+            done()
+          })
+        })
       })
     })
   })