#10182 fix(core): Prevent include_paths from escaping project root Pull request opened by edgarrmondragon Description ProjectFiles resolved

include_paths

glob patterns from

meltano.yml

without verifying the match stayed under the project root, so a pattern like

../sibling/meltano.yml

let one project's config mutation read and overwrite a sibling project's meltano.yml. Add a containment check at both the glob-resolution source and the

_write_file

sink, and cover it with regression tests for a literal

../

traversal and a same-directory symlink escaping the root. Checklist • I have read the contribution guide Was generative AI tooling used to co-author this PR? • Yes (please specify the tool below) Related Issues • Closes #XXXX Summary by Sourcery Enforce that include_paths-resolved project files remain within the project root and adjust internal path handling to treat trusted project files explicitly, preventing cross-project config reads/writes. Bug Fixes: • Prevent include_paths glob patterns from resolving to files outside the project root, including via relative directory traversal or symlinks. Enhancements: • Introduce a validated InProjectPath type and associated path/content mappings to make project file reading and writing rely only on trusted, root-contained paths. • Improve logging messages and type annotations in ProjectFiles for clearer error reporting and stronger typing around plugin file indexing and YAML splitting. Tests: • Add regression tests covering invalid include paths, globbing the root meltano.yml, non-file matches, and traversal attempts via ../ paths and symlinks, including YAML parse error handling for malformed include files. meltano/meltano