Hardening: Block path traversal in package install via composer.json name#237

Open

Copilot wants to merge 7 commits intomainfrom

copilot/hardening-path-traversal-issue

Commits on Apr 27, 2026

Initial plan
Copilot
authored
Add path traversal hardening: validate package name and check destination path

Copilot
and
swissspidy
authored
Rename test helper PHP file for clarity

Copilot
and
swissspidy
authored
Apply suggestion from @swissspidy
swissspidy
authored
Fix docblock wording and add no-artifact assertions to traversal test

Copilot
and
swissspidy
authored
Fix test: assert vendor/autoload.php does not exist instead of checking contents

Copilot
and
swissspidy
authored
Fix is_child_path: resolve .. segments and use case-insensitive comparison on Windows

Copilot
and
swissspidy
authored