Fix npm crawler FIFO-safe .yarnrc read and normalize modules-folder path

- Replace bare std::fs::read_to_string with read_regular_to_string_sync for .yarnrc to prevent blocking on FIFOs
- Add normalize_modules_folder function to handle path normalization for --modules-folder config values
- Apply path_safety::is_safe_multi_segment check to prevent path traversal and escaping project root
- Add comprehensive tests for normalize_modules_folder covering edge cases

Author: cursoragent

crates/socket-patch-core/src/crawlers/npm_crawler.rs

@@ -8,7 +8,7 @@ use serde::Deserialize;
 use super::types::{CrawledPackage, CrawlerOptions};
 use super::walk_pool::{par_map, run_walk};
 use crate::patch::path_safety;
-use crate::utils::fs::{is_dir, is_dir_sync, read_dir_entries_sync};
+use crate::utils::fs::{is_dir, is_dir_sync, read_dir_entries_sync, read_regular_to_string_sync};
 use crate::utils::purl::{percent_decode_purl_component, strip_purl_qualifiers};
 use crate::vendor::vlt_lock_text::decode_vlt_dep_id;
 
@@ -46,7 +46,11 @@ const SKIP_DIRS: &[&str] = &[
 pub(super) fn configured_install_roots(start_path: &Path) -> Vec<PathBuf> {
     let mut roots = Vec::new();
     if let Some(folder) = yarnrc_modules_folder(start_path) {
-        roots.push(start_path.join(folder));
+        if let Some(normalized) = normalize_modules_folder(&folder) {
+            if path_safety::is_safe_multi_segment(&normalized) {
+                roots.push(start_path.join(normalized));
+            }
+        }
     }
     if start_path.join("rush.json").is_file() {
         roots.push(start_path.join("common").join("temp").join("node_modules"));
@@ -78,10 +82,12 @@ pub(super) fn merge_configured_install_roots(
 }
 
 /// The `--modules-folder` value from the nearest `.yarnrc` at or above
-/// `start_path`, if any `.yarnrc` sets it.
+/// `start_path`, if any `.yarnrc` sets it. Read `.yarnrc` via
+/// `read_regular_to_string_sync` for the same reason `package.json` is:
+/// a FIFO planted at that workspace path would wedge a plain read forever.
 fn yarnrc_modules_folder(start_path: &Path) -> Option<String> {
     start_path.ancestors().find_map(|dir| {
-        let rc = std::fs::read_to_string(dir.join(".yarnrc")).ok()?;
+        let rc = read_regular_to_string_sync(&dir.join(".yarnrc")).ok()?;
         parse_yarnrc_modules_folder(&rc)
     })
 }
@@ -137,6 +143,29 @@ fn split_yarnrc_token(s: &str, is_key: bool) -> Option<(String, &str)> {
     (end > 0).then(|| (s[..end].to_string(), &s[end..]))
 }
 
+/// Reduce a `--modules-folder` value to plain `a/b` segments before the
+/// safety gate. Yarn accepts `./`-prefixed and `.`-interleaved values
+/// (`./deps`, `lib/./deps`) and either separator, so those shapes must
+/// resolve rather than be refused. `..` is resolved lexically the same way
+/// Composer's config.vendor-dir normalization does; a value that climbs
+/// above the project root (or reduces to it) fails closed as `None`.
+fn normalize_modules_folder(raw: &str) -> Option<String> {
+    if raw.starts_with(['/', '\\']) {
+        return None;
+    }
+    let mut segments: Vec<&str> = Vec::new();
+    for segment in raw.split(['/', '\\']) {
+        match segment {
+            "" | "." => {}
+            ".." => {
+                segments.pop()?;
+            }
+            other => segments.push(other),
+        }
+    }
+    (!segments.is_empty()).then(|| segments.join("/"))
+}
+
 // ---------------------------------------------------------------------------
 // Helper: read and parse package.json
 // ---------------------------------------------------------------------------
@@ -1237,7 +1266,11 @@ impl NpmCrawler {
     /// Inside a store entry (`store_entry`) a link is a dependency edge into
     /// a sibling entry, whose own visit records that copy, so only a real
     /// directory there matches.
-    fn visit_resolver_dir(nm_path: PathBuf, store_entry: bool, pending: &[Target]) -> ResolverVisit {
+    fn visit_resolver_dir(
+        nm_path: PathBuf,
+        store_entry: bool,
+        pending: &[Target],
+    ) -> ResolverVisit {
         let listing = list_dir_sync(&nm_path);
         let probe_filter = ProbeFilter::new(&listing);
         let matched = pending
@@ -4329,6 +4362,30 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_normalize_modules_folder() {
+        let n = normalize_modules_folder;
+        // Yarn-legal `./` prefixes and `.` segments reduce to the
+        // plain path; either separator is accepted.
+        assert_eq!(n("./deps").as_deref(), Some("deps"));
+        assert_eq!(n("./lib/deps").as_deref(), Some("lib/deps"));
+        assert_eq!(n("lib/./deps").as_deref(), Some("lib/deps"));
+        assert_eq!(n("lib\\deps").as_deref(), Some("lib/deps"));
+        assert_eq!(n("lib/../deps").as_deref(), Some("deps"));
+        assert_eq!(n("deps").as_deref(), Some("deps"));
+        // Escaping the project, reducing to it, or absolute — fail closed.
+        assert_eq!(n(".."), None);
+        assert_eq!(n("../elsewhere"), None);
+        assert_eq!(n("lib/../.."), None);
+        assert_eq!(n("."), None);
+        assert_eq!(n("a/.."), None);
+        assert_eq!(n("/etc/deps"), None);
+        assert_eq!(n("\\\\share\\deps"), None);
+        // A drive-letter segment survives normalization; the
+        // `is_safe_multi_segment` gate downstream rejects the colon.
+        assert_eq!(n("C:\\deps").as_deref(), Some("C:/deps"));
+    }
+
     fn local_options(cwd: &Path) -> CrawlerOptions {
         CrawlerOptions {
             cwd: cwd.to_path_buf(),