chore(backend): Harden joinPaths against traversal

.changeset/dark-bars-wink.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Add path traversal protections in `joinPaths`

packages/backend/src/util/__tests__/path.test.ts

@@ -38,4 +38,28 @@ describe('utils.joinPaths(...args)', () => {
   it('handles no input', () => {
     expect(joinPaths()).toBe('');
   });
+
+  it('rejects literal ".." segments', () => {
+    expect(() => joinPaths('/sessions', 'sess_abc', 'tokens', '../../../users')).toThrow();
+    expect(() => joinPaths('/sessions', '..')).toThrow();
+  });
+
+  it('rejects "." segments', () => {
+    expect(() => joinPaths('foo/./bar')).toThrow();
+    expect(() => joinPaths('foo', '.', 'bar')).toThrow();
+    expect(() => joinPaths('foo', './', 'bar')).toThrow();
+  });
+
+  it('rejects percent-encoded dot segments', () => {
+    expect(() => joinPaths('/sessions', 'sess_abc', 'tokens', '%2e%2e/users')).toThrow();
+    expect(() => joinPaths('/sessions', 'sess_abc', 'tokens', '%2E%2E/users')).toThrow();
+    expect(() => joinPaths('/sessions', 'sess_abc', 'tokens', '.%2E/users')).toThrow();
+    expect(() => joinPaths('foo', '%2e', 'bar')).toThrow();
+  });
+
+  it('allows legitimate URLs and ID-like segments', () => {
+    expect(joinPaths('https://api.clerk.com', 'v1', '/sessions/sess_abc/tokens/supabase')).toBe(
+      'https://api.clerk.com/v1/sessions/sess_abc/tokens/supabase',
+    );
+  });
 });

packages/backend/src/util/path.ts

@@ -3,9 +3,27 @@ const MULTIPLE_SEPARATOR_REGEX = new RegExp('(?<!:)' + SEPARATOR + '{1,}', 'g');
 
 type PathString = string | null | undefined;
 
+function isDotSegment(segment: string): boolean {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(segment);
+  } catch {
+    decoded = segment;
+  }
+  return decoded === '.' || decoded === '..';
+}
+
 export function joinPaths(...args: PathString[]): string {
-  return args
+  const result = args
     .filter(p => p)
     .join(SEPARATOR)
     .replace(MULTIPLE_SEPARATOR_REGEX, SEPARATOR);
+
+  for (const segment of result.split(SEPARATOR)) {
+    if (isDotSegment(segment)) {
+      throw new Error(`joinPaths: "." and ".." path segments are not allowed (received "${result}")`);
+    }
+  }
+
+  return result;
 }