pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

## Summary A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a frozen lockfile, traversal segments could create links outside the intended project or `node_modules` boundary. This patch validates dependency names and every virtual-store slot before creating directories, links, bins, or hoisted entries. ## Security boundary - A shared safe-join helper rejects traversal, absolute, platform-specific, and reserved dependency names before filesystem materialization. - Direct and transitive dependency links, package links, bin destinations, and public/private hoist destinations use the same containment rule. - Global virtual-store slots validate the complete slot path, including version-derived components, before directory creation. - Snapshot slots and package names are checked before store initialization and before the current-lockfile fast path, closing the warm-install bypass. - Rejections preserve `ERR_PNPM_INVALID_DEPENDENCY_NAME`. ## Exploit replay Before the patch, `pacquet install --frozen-lockfile --trust-lockfile` accepted a `../../escaped-link` dependency key and created a symlink outside the project. With this patch, the same lockfile is rejected before materialization and no outside link is created. ## Files changed - `pacquet/crates/package-manager/src/safe_join_modules_dir.rs` defines the shared containment rule. - Install, symlink, bin, hoist, virtual-store, and frozen-lockfile paths call that helper before filesystem materialization. - The corresponding `tests.rs` files cover every sink, including warm installs and global virtual-store slots. ## Commands run ```text $ cargo test --locked -p pacquet-package-manager --lib PASS: 434 tests $ cargo clippy --locked -p pacquet-package-manager --all-targets -- --deny warnings PASS $ cargo fmt --all -- --check PASS ``` ## Validation - Full pacquet package-manager suite: 434 passed. - Focused regressions cover direct and transitive aliases, bins, hoists, package names, global virtual-store version traversal, and a poisoned prior-install slot. - `cargo clippy -p pacquet-package-manager --all-targets -- -D warnings`: passed. - `cargo fmt --all -- --check` and `git diff --check`: passed. ## Compatibility Valid unscoped and scoped dependency aliases continue to work. The reproduced escape was specific to pacquet, so this branch does not change the TypeScript CLI or the lockfile format. --- Written by an agent (Codex, GPT-5). Source Code Location: https://github.com/pnpm/pnpm Affected Packages: - npm:pnpm, affected >= 12.0.0-alpha.0, < 12.0.0-alpha.5, patched in 12.0.0-alpha.5 CWEs: - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CWE-59: Improper Link Resolution Before File Access ('Link Following') - CWE-73: External Control of File Name or Path CVSS: - Primary: score 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L - CVSS_V3: score 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L References: - https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv - https://github.com/pnpm/pnpm/pull/12872 - https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7 - https://github.com/advisories/GHSA-2rx9-3g3h-c2jv