A Claude-assisted change ran the C preprocessor over Fortran files in indexed trees, and preprocessor includes pulled other files from the host into the generated graph.

+_RECURSION_LIMIT = 10_000+++def _raise_recursion_limit() -> None:+    if sys.getrecursionlimit() < _RECURSION_LIMIT:+        sys.setrecursionlimit(_RECURSION_LIMIT)+++def _safe_extract(extractor: Callable, path: Path) -> dict:+    try:

+  def _make_id(*parts: str) -> str:     """Build a stable node ID from one or more name parts."""@@ -30,9 +48,44 @@ def _file_stem(path: Path) -> str: _TSCONFIG_ALIAS_CACHE: dict[str, dict[str, str]] = {}  +def _read_tsconfig_aliases(tsconfig: Path, base_dir: Path, seen: set) -> dict[str, str]:+    """Recursively read path aliases from a tsconfig, following extends chains.++    Child config paths override parent. Circular extends are detected via seen set.+    npm package configs (e.g. @tsconfig/svelte) are skipped since they're not on disk.+    """+    if str(tsconfig) in seen:+        return {}+    seen.add(str(tsconfig))+    try:+        data = json.loads(tsconfig.read_text(encoding="utf-8"))+    except Exception:+        return {}++    aliases: dict[str, str] = {}+    extends = data.get("extends")

+    paths = data.get("compilerOptions", {}).get("paths", {})+    for alias, targets in paths.items():+        if not targets:+            continue+        alias_prefix = alias.rstrip("/*")+        target_base = targets[0].rstrip("/*")+        aliases[alias_prefix] = str(base_dir / target_base)++    return aliases++ def _load_tsconfig_aliases(start_dir: Path) -> dict[str, str]:     """Walk up from start_dir to find tsconfig.json and return compilerOptions.paths aliases. +    Follows extends chains so SvelteKit/Nuxt/NestJS inherited aliases are included.     Returns a dict mapping alias prefix (e.g. "@/") to resolved base dir (e.g. "src/").     Result is cached by tsconfig path string.     """@@ -42,20 +95,7 @@ def _load_tsconfig_aliases(start_dir: Path) -> dict[str, str]:         if tsconfig.exists():             key = str(tsconfig)             if key not in _TSCONFIG_ALIAS_CACHE:-                try:-                    data = json.loads(tsconfig.read_text(encoding="utf-8"))-                    paths = data.get("compilerOptions", {}).get("paths", {})-                    aliases: dict[str, str] = {}-                    for alias, targets in paths.items():-                        if not targets:-                            continue-                        # Strip trailing /* from alias and target-                        alias_prefix = alias.rstrip("/*")-                        target_base = targets[0].rstrip("/*")-                        aliases[alias_prefix] = str(candidate / target_base)-                    _TSCONFIG_ALIAS_CACHE[key] = aliases-                except Exception:-                    _TSCONFIG_ALIAS_CACHE[key] = {}+                _TSCONFIG_ALIAS_CACHE[key] = _read_tsconfig_aliases(tsconfig, candidate, seen=set())             return _TSCONFIG_ALIAS_CACHE[key]

+import re from pathlib import Path from graphify.extractors.base import _file_stem, _make_id, _read_text   _FORTRAN_CPP_EXTS = {".F", ".F90", ".F95", ".F03", ".F08"} +# A cpp `#include` directive at the start of a (optionally indented) line, in+# either the `"..."` or `<...>` form. Matched on raw bytes before preprocessing.

+    includes and always honours absolute include paths, regardless of+    `-nostdinc`/`-I` — so a malicious capital-F Fortran source containing+    `#include "/etc/passwd"` or `#include "../../../secret"` would inline+    arbitrary host files into the graph we ship to the LLM and persist to disk+    (GHSA-pcc4-rvhr-2pr8, CWE-22/73/200). The `-nostdinc -I /dev/null` mitigation+    did not cover those two cases. Removing the directives entirely keeps macro+    expansion (the reason capital-F files need cpp — `#ifdef MPI`, `#define+    REAL8`) while making host-file reads impossible. Cross-file include fidelity+    is lost, which is an acceptable trade for closing an arbitrary-read vector on+    the default offline path. Each stripped line is blanked (not deleted) so+    reported line numbers still match the original source.+    """+    return b"\n".join(+        b"" if _INCLUDE_DIRECTIVE_RE.match(line) else line+        for line in source.split(b"\n")

-    conventionally require C preprocessor expansion (#ifdef MPI, #define REAL8, etc.)-    before parsing.--    Security (F-007): we pass `-nostdinc` and `-I /dev/null` so a malicious-    source file containing `#include "/home/victim/.ssh/id_rsa"` (or any other-    include directive) cannot inline arbitrary host files into the output that-    we then ship to an LLM. Without these flags `cpp` happily resolves any-    relative or absolute include path it can read, which is a corpus-side-    file-exfiltration vector.+    Falls back to (include-stripped) raw file bytes if cpp is not available.+    Capital-F extensions conventionally require C preprocessor expansion

+    Feeding stdin (rather than a file path) also removes the `-I/etc/x.F90`+    argument-injection edge case entirely.

     try:-        # Pass an absolute path so a corpus file named like "-I/etc/x.F90" cannot-        # be parsed by cpp as an option (cpp does not accept a "--" end-of-options-        # terminator). What matters is that an absolute path cannot begin with-        # "-" — not that it begins with "/", which only holds on POSIX (a Windows-        # absolute path starts with a drive letter, and is equally safe).         result = subprocess.run(-            ["cpp", "-w", "-P", "-nostdinc", "-I", "/dev/null", str(path.resolve())],+            ["cpp", "-w", "-P", "-nostdinc", "-I", "/dev/null"],+            input=safe,             capture_output=True,             timeout=30,         )         if result.returncode == 0 and result.stdout:             return result.stdout     except Exception:         pass-    return path.read_bytes()+    return safe  def extract_fortran(path: Path) -> dict: