DimoHG eba2af2c64 fix(cursor): add path traversal checks and require per-plugin manifest ...

Address two issues flagged in PR review:

1. Validate pluginRoot and source with isSafeRelativePath before using
   them in path.resolve. Without this, absolute paths or .. traversals
   in marketplace.json would pass validation silently.

2. Error when the per-plugin .cursor-plugin/plugin.json is missing
   instead of silently skipping it. A missing manifest would prevent
   the plugin from loading, so the validator should catch it.

Made-with: Cursor

2026-03-10 13:27:23 +02:00

6.9 KiB

Raw Permalink Blame History

View Raw