feat(cli): disallow path pointing to parent directories (#2125)

Linting parent directories introduces undefined behavior because
the intention is not clear. This is a future proof precaution.

closes #1887

crates/oxc_cli/src/command.rs

@@ -129,10 +129,20 @@ pub struct LintOptions {
     pub config: Option<PathBuf>,
 
     /// Single file, single path or list of paths
-    #[bpaf(positional("PATH"), many)]
+    #[bpaf(positional("PATH"), many, guard(validate_paths, PATHS_ERROR_MESSAGE))]
     pub paths: Vec<PathBuf>,
 }
 
+fn validate_paths(paths: &Vec<PathBuf>) -> bool {
+    if paths.is_empty() {
+        true
+    } else {
+        paths.iter().all(|p| p.components().next() != Some(std::path::Component::ParentDir))
+    }
+}
+
+const PATHS_ERROR_MESSAGE: &str = "PATH cannot start with \"..\"";
+
 // This is formatted according to
 // <https://docs.rs/bpaf/latest/bpaf/params/struct.NamedArg.html#method.help>
 /// Allowing / Denying Multiple Lints
@@ -335,6 +345,19 @@ mod lint_options {
         );
     }
 
+    #[test]
+    fn no_parent_path() {
+        match lint_command().run_inner(&["../parent_dir"]) {
+            Ok(_) => panic!("Should not allow parent dir"),
+            Err(err) => match err {
+                bpaf::ParseFailure::Stderr(doc) => {
+                    assert_eq!("`../parent_dir`: PATH cannot start with \"..\"", format!("{doc}"));
+                }
+                _ => unreachable!(),
+            },
+        }
+    }
+
     #[test]
     fn fix() {
         let options = get_lint_options("--fix test.js");