fix(commands): tighten outside-root path check to match path element

Address review feedback from coderabbitai on pkg/commands/template.go:
`strings.HasPrefix(relPath, "..")` also matched valid paths whose
first directory component literally starts with "..", such as
`..templates/controlplane.yaml`. On the template command path, that
sent a legitimate input into the templates/<basename> fallback and
silently loaded a different file when one happened to exist under
templates/.

Extract isOutsideRoot helper that matches ".\".\" + path
separator" or the exact ".." element, and route all three duplicate
check sites (apply.go resolveTemplatePaths, template.go generateOutput
modeline branch, template.go resolveEngineTemplatePaths) through it.
Add a regression test that seeds a rootDir/..templates/controlplane.yaml
real target alongside a rootDir/templates/controlplane.yaml decoy and
asserts the real target is returned.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

Author: lexfrei

pkg/commands/apply.go

@@ -259,6 +259,15 @@ func wrapWithNodeContext(f func(ctx context.Context, c *client.Client) error) fu
 	}
 }
 
+// isOutsideRoot reports whether a cleaned relative path escapes the
+// project root. A HasPrefix(".." ) test would misclassify sibling
+// directories whose first path element merely starts with "..", such
+// as "..templates/controlplane.yaml"; we match a full path element
+// instead.
+func isOutsideRoot(relPath string) bool {
+	return relPath == ".." || strings.HasPrefix(relPath, ".."+string(filepath.Separator))
+}
+
 // resolveTemplatePaths resolves template file paths relative to the project root,
 // normalizing them for the Helm engine (forward slashes).
 // Relative paths from the modeline are resolved against rootDir, not CWD.
@@ -300,7 +309,7 @@ func resolveTemplatePaths(templates []string, rootDir string) []string {
 			continue
 		}
 		relPath = filepath.Clean(relPath)
-		if strings.HasPrefix(relPath, "..") {
+		if isOutsideRoot(relPath) {
 			// Path goes outside project root — use original path as-is
 			resolved[i] = engine.NormalizeTemplatePath(templatePath)
 			continue

pkg/commands/apply_test.go

@@ -95,6 +95,12 @@ func TestResolveTemplatePaths(t *testing.T) {
 	if err := os.MkdirAll(filepath.Join(tmpRoot, "templates"), 0o755); err != nil {
 		t.Fatalf("failed to create templates dir: %v", err)
 	}
+	// A sibling directory whose name literally starts with "..". A naive
+	// HasPrefix(relPath, "..") check would misclassify it as outside-root;
+	// the resolver must treat ".." as a full path element, not a prefix.
+	if err := os.MkdirAll(filepath.Join(tmpRoot, "..templates"), 0o755); err != nil {
+		t.Fatalf("failed to create ..templates dir: %v", err)
+	}
 
 	// Build a platform-portable absolute path outside tmpRoot.
 	// filepath.VolumeName is "" on POSIX (yielding e.g. "/other/...") and
@@ -142,6 +148,15 @@ func TestResolveTemplatePaths(t *testing.T) {
 			rootDir:   tmpRoot,
 			want:      []string{filepath.ToSlash(absOutside)},
 		},
+		{
+			// Directory name literally starting with "..". If the
+			// outside-root check used HasPrefix("..") it would wrongly
+			// drop this path back to the original input.
+			name:      "sibling dir whose name starts with .. is inside rootDir",
+			templates: []string{"..templates/controlplane.yaml"},
+			rootDir:   tmpRoot,
+			want:      []string{"..templates/controlplane.yaml"},
+		},
 	}
 
 	for _, tt := range tests {

pkg/commands/template.go

@@ -20,7 +20,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"github.com/cozystack/talm/pkg/engine"
 	"github.com/cozystack/talm/pkg/modeline"
@@ -280,7 +279,7 @@ func generateOutput(ctx context.Context, c *client.Client, args []string) (strin
 			// Normalize the path (remove .. and .)
 			relPath = filepath.Clean(relPath)
 			// Check if path goes outside root
-			if strings.HasPrefix(relPath, "..") {
+			if isOutsideRoot(relPath) {
 				// Path goes outside root, try to find file in templates/ relative to root
 				// This handles cases like "../templates/controlplane.yaml" when file is actually in root/templates/
 				templateName := filepath.Base(templatePath)
@@ -421,7 +420,7 @@ func resolveEngineTemplatePaths(templateFiles []string, rootDir string) []string
 			continue
 		}
 		relPath = filepath.Clean(relPath)
-		if strings.HasPrefix(relPath, "..") {
+		if isOutsideRoot(relPath) {
 			templateName := filepath.Base(templatePath)
 			possiblePath := filepath.Join("templates", templateName)
 			fullPath := filepath.Join(absRootDir, possiblePath)

pkg/commands/template_test.go

@@ -0,0 +1,69 @@
+// Copyright Cozystack Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package commands
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestResolveEngineTemplatePaths_DotDotPrefixedDir pins that a
+// sibling directory whose name literally starts with ".." (e.g.
+// "..templates") is not mistaken for an outside-root path and routed
+// through the templates/<basename> fallback — that would silently
+// substitute a different file when one exists under templates/.
+func TestResolveEngineTemplatePaths_DotDotPrefixedDir(t *testing.T) {
+	// Resolve symlinks so the rootDir and the post-Chdir cwd share the
+	// same canonical form — on macOS, t.TempDir lives under /var/...
+	// but os.Getwd returns the realpath /private/var/... which throws
+	// off the Rel computation.
+	rootDir, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatalf("eval symlinks: %v", err)
+	}
+	// Seed both ..templates/controlplane.yaml (the real target) and
+	// templates/controlplane.yaml (a decoy the buggy fallback would
+	// have picked instead).
+	if err := os.MkdirAll(filepath.Join(rootDir, "..templates"), 0o755); err != nil {
+		t.Fatalf("mkdir ..templates: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(rootDir, "..templates", "controlplane.yaml"), []byte("real"), 0o600); err != nil {
+		t.Fatalf("seed ..templates/controlplane.yaml: %v", err)
+	}
+	if err := os.MkdirAll(filepath.Join(rootDir, "templates"), 0o755); err != nil {
+		t.Fatalf("mkdir templates: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(rootDir, "templates", "controlplane.yaml"), []byte("decoy"), 0o600); err != nil {
+		t.Fatalf("seed templates/controlplane.yaml: %v", err)
+	}
+
+	origCwd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("getwd: %v", err)
+	}
+	if err := os.Chdir(rootDir); err != nil {
+		t.Fatalf("chdir: %v", err)
+	}
+	t.Cleanup(func() { _ = os.Chdir(origCwd) })
+
+	got := resolveEngineTemplatePaths([]string{"..templates/controlplane.yaml"}, rootDir)
+	if len(got) != 1 {
+		t.Fatalf("len = %d, want 1", len(got))
+	}
+	if got[0] != "..templates/controlplane.yaml" {
+		t.Errorf("got %q, want %q (the ..templates dir was misclassified as outside-root and routed through the basename fallback)", got[0], "..templates/controlplane.yaml")
+	}
+}