AI-written code accepted an unvalidated filePath in matchFileSnapshot, letting attacker-controlled input write arbitrary files and create directories during snapshot updates.

- * Serialize a value into a human-readable snapshot string.+ * Configuration for the serialize function's pretty-formatting behavior.+ */+export interface SerializeConfig {+  indent?: number;+  maxDepth?: number;+  min?: boolean;+  printBasicPrototype?: boolean;+}++/**+ * Printer function type passed to custom serializers, allowing them+ * to recursively serialize nested values.+ */+export type PrinterFn = (+  value: unknown,+  config: SerializeConfig,+  indentation: string,+  depth: number,+  refs: Set<unknown>,+) => string;++/**+ * Interface for custom snapshot serializer plugins.+ */+export interface SnapshotSerializer {+  test(value: unknown): boolean;+  serialize(+    value: unknown,+    config: SerializeConfig,+    indentation: string,+    depth: number,+    refs: Set<unknown>,+    printer: PrinterFn,+  ): string;+}++const serializers: SnapshotSerializer[] = [];++/**+ * Register a custom snapshot serializer plugin.+ */+export function addSerializer(serializer: SnapshotSerializer): void {+  serializers.push(serializer);+}++/**+ * Remove a previously registered custom snapshot serializer plugin.+ */+export function removeSerializer(serializer: SnapshotSerializer): void {+  const idx = serializers.indexOf(serializer);+  if (idx !== -1) {+    serializers.splice(idx, 1);+  }+}++/**+ * Get all currently registered custom snapshot serializers.+ */+export function getSerializers(): SnapshotSerializer[] {

+  printBasicPrototype: true,+};

+/**+ * Internal recursive printer.  */-export function serialize(value: unknown): string {+function printValue(+  value: unknown,

+ */++import * as fs from 'node:fs';+import * as path from 'node:path';++/**+ * Interface for snapshot file I/O operations.+ * Allows different environments (Node, browser, etc.) to provide+ * their own implementations.+ */+export interface SnapshotEnvironment {+  /** Get the version string for snapshot file headers. */+  getVersion(): string;++  /** Get the header comment for snapshot files. */+  getHeader(): string;++  /** Read the contents of a snapshot file. Returns empty string if not found. */+  readSnapshotFile(filepath: string): Promise<string>;++  /** Write content to a snapshot file, creating directories as needed. */+  saveSnapshotFile(filepath: string, content: string): Promise<void>;++  /** Resolve the snapshot file path for a given test file path. */+  resolveSnapshotPath(testPath: string): string;++  /** Remove a snapshot file. */+  removeSnapshotFile(filepath: string): Promise<void>;++  /** Ensure a directory exists, creating it recursively if needed. */+  prepareDirectory(dirPath: string): Promise<void>;+}+

+    this.version = version;+  }++  getVersion(): string {+    return this.version;+  }++  getHeader(): string {+    return `// Snapshot v${this.version}`;+  }++  async readSnapshotFile(filepath: string): Promise<string> {+    try {+      return fs.readFileSync(filepath, 'utf-8');+    } catch {+      return '';+    }+  }++  async saveSnapshotFile(filepath: string, content: string): Promise<void> {+    const dir = path.dirname(filepath);+    await this.prepareDirectory(dir);+    fs.writeFileSync(filepath, content, 'utf-8');+  }++  resolveSnapshotPath(testPath: string): string {+    const dir = path.dirname(testPath);+    const basename = path.basename(testPath, path.extname(testPath));+    return path.join(dir, '__snapshots__', `${basename}.snap`);+  }++  async removeSnapshotFile(filepath: string): Promise<void> {+    try {+      fs.unlinkSync(filepath);+    } catch {+      // File may not exist, ignore+    }+  }++  async prepareDirectory(dirPath: string): Promise<void> {+    if (!fs.existsSync(dirPath)) {+      fs.mkdirSync(dirPath, { recursive: true });+    }+  }+}

+ * @module snapshot-client+ */++import { serialize } from './snapshots.js';+import type { SnapshotEnvironment } from './snapshot-environment.js';++/**+ * Summary of snapshot operations for a single client.+ */+export interface SnapshotSummary {+  added: number;+  updated: number;+  matched: number;+  testName: string;+}++/**+ * SnapshotClient manages the lifecycle of snapshot assertions for a test.+ * Call prepareTest() before each test, assert() for each snapshot check,+ * and finishTest() after to collect results.+ */+export class SnapshotClient {+  private testName: string = '';+  private snapshotCount: number = 0;+  private snapshots: Map<string, string> = new Map();+  private added: number = 0;+  private updated: number = 0;+  private matched: number = 0;+  private environment: SnapshotEnvironment;+  private snapshotFilePath: string = '';++  constructor(environment: SnapshotEnvironment) {+    this.environment = environment;+  }++  /**+   * Prepare the client for a new test. Resets the snapshot counter+   * and sets the test name.+   */+  prepareTest(testName: string): void {+    this.testName = testName;+    this.snapshotCount = 0;+  }++  /**+   * Load snapshots from a file into the internal map.+   * Parses the snapshot file format: exports['name'] = `value`;+   */+  async loadSnapshots(filepath: string): Promise<void> {+    this.snapshotFilePath = filepath;+    const content = await this.environment.readSnapshotFile(filepath);+    if (!content) return;++    const regex = /exports\['(.+?)'\]\s*=\s*`([\s\S]*?)`;/g;+    let match: RegExpExecArray | null = regex.exec(content);+    while (match !== null) {+      const name = match[1];+      const value = match[2];+      if (name !== undefined && value !== undefined) {+        this.snapshots.set(name, unescapeFromTemplate(value));+      }+      match = regex.exec(content);+    }+  }+

+      this.snapshots.set(key, serialized);+      this.added++;+      return;+    }++    if (shouldUpdate) {+      const existing = this.snapshots.get(key);

+): void {+  const root = projectRoot ?? process.cwd();+  const resolved = path.resolve(root, filePath);+  if (!resolved.startsWith(root + path.sep) && resolved !== root) {+    throw new Error(+      `File snapshot path must be within the project directory: ${filePath}`,+    );+  }+   const serialized = serialize(actual);   const mode = resolveUpdateMode();-  const fileExists = fs.existsSync(filePath);+  const fileExists = fs.existsSync(resolved);    if (!fileExists) {     if (mode === 'all' || mode === 'new') {       // Create the file-      const dir = path.dirname(filePath);+      const dir = path.dirname(resolved);

-  const stored = fs.readFileSync(filePath, 'utf-8');+  const stored = fs.readFileSync(resolved, 'utf-8');   if (serialized === stored) {     return; // match   }

     }

+    }+  });+

+    }+  }); });  describe('auto-incrementing snapshot names', () => {