From 87a562e24b51702de576339fca5925962d1bbeee Mon Sep 17 00:00:00 2001
From: Bark <32035685+userwiths@users.noreply.github.com>
Date: Sun, 5 Jan 2025 15:13:19 +0200
Subject: [PATCH] Fix root directory traversal issue (#14747)

fixes : #13729

During dot expansion, the "parent" was added even if it was after the
root (`/../../`).
Added additional check that skips appending elements to the path
representation if the parent folder is the root folder.
---
 crates/nu-path/src/dots.rs | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/crates/nu-path/src/dots.rs b/crates/nu-path/src/dots.rs
index 8d6341cb46..c001451c68 100644
--- a/crates/nu-path/src/dots.rs
+++ b/crates/nu-path/src/dots.rs
@@ -60,7 +60,13 @@ pub fn expand_dots(path: impl AsRef<Path>) -> PathBuf {
             Component::CurDir if last_component_is_normal(&result) => {
                 // no-op
             }
-            _ => result.push(component),
+            _ => {
+                let prev_component = result.components().last();
+                if prev_component == Some(Component::RootDir) && component == Component::ParentDir {
+                    continue;
+                }
+                result.push(component)
+            }
         }
     }
 
@@ -215,11 +221,7 @@ mod test_expand_dots {
     #[test]
     fn backtrack_to_root() {
         let path = Path::new("/foo/bar/../../../../baz");
-        let expected = if cfg!(windows) {
-            r"\..\..\baz"
-        } else {
-            "/../../baz"
-        };
+        let expected = if cfg!(windows) { r"\baz" } else { "/baz" };
         assert_path_eq!(expand_dots(path), expected);
     }
 }