{"version":"2.1.268","anchor":"plugin-manifest-path-traversal-checks-consolidated-into-a-sh","canonical_anchor":"plugin-manifest-path-traversal-checks-consolidated-into-a-sh","heading":"Plugin manifest path-traversal checks consolidated into a shared helper","tier":"internal","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/plugin-manifest-path-traversal-checks-consolidated-into-a-sh","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Plugin manifest path-traversal checks consolidated into a shared helper\n\nPlugin path-traversal checks unified into one shared helper function\n\n**What**\n\nSeveral places that check plugin-declared paths for safety \u2014 commands, MCP server file references, and `plugin.json` marketplace source paths \u2014 used to each run their own simple check for \"..\" in the path. They now all call a single shared helper function instead. A related helper that checks whether a directory exists also changed: it now takes the plugin's root folder plus a subpath, rather than an already-resolved path.\n\n**Why**\n\nConsolidating these checks into one helper reduces the chance that one of the several places validating plugin paths is checked inconsistently or missed when the logic needs to change.\n\n- Area: Plugins\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 0\/5"}