[andrew]

An attacker-supplied lockfile could make pin verify hash files outside the output directory and print their digests. A traversing pin:out_dir could also expose filenames through the extra-file scan.

Validate lockfile paths before reading assets, then use os.Root to constrain the output directory to the project and asset reads and directory scans to that output directory. This also rejects symlink escapes while preserving internal symlinks and missing-file reporting.

Add CLI regression coverage for traversal, symlink escapes, empty asset lists, and valid relative output directories.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.