fix: path traversal on windows

packages/webcrack/src/unpack/bundle.ts

@@ -1,11 +1,8 @@
 import traverse from '@babel/traverse';
 import type * as m from '@codemod/matchers';
-import { posix } from 'node:path';
+import { dirname, join, normalize } from 'node:path';
 import type { Module } from './module';
 
-// eslint-disable-next-line @typescript-eslint/unbound-method
-const { dirname, join, normalize } = posix;
-
 export class Bundle {
   type: 'webpack' | 'browserify';
   entryId: string;

packages/webcrack/src/unpack/test/samples/webpack-path-traversal-windows.js

@@ -0,0 +1,20 @@
+(function (e) {
+  var n = {};
+  function o(r) {
+    if (n[r]) {
+      return n[r].exports;
+    }
+    var a = (n[r] = {
+      i: r,
+      l: false,
+      exports: {},
+    });
+    e[r].call(a.exports, a, a.exports, o);
+    a.l = true;
+    return a.exports;
+  }
+  o.p = '';
+  o((o.s = 386));
+})({
+  './\\..\\node_modules\\debug\\src\\index': function (e, t, n) {},
+});

packages/webcrack/src/unpack/test/unpack.test.ts

@@ -26,7 +26,7 @@ test('path mapping', async () => {
   expect(bundle!).toMatchSnapshot();
 });
 
-test('prevent path traversal', async () => {
+test('prevent path traversal (posix)', async () => {
   const code = await readFile(
     join(SAMPLES_DIR, 'webpack-path-traversal.js'),
     'utf8',
@@ -37,3 +37,15 @@ test('prevent path traversal', async () => {
   const dir = join(tmpdir(), 'path-traversal-test');
   await expect(bundle!.save(dir)).rejects.toThrow('path traversal');
 });
+
+test('prevent path traversal (windows)', async () => {
+  const code = await readFile(
+    join(SAMPLES_DIR, 'webpack-path-traversal-windows.js'),
+    'utf8',
+  );
+  const bundle = unpack(code);
+  expect(bundle).toBeDefined();
+
+  const dir = join(tmpdir(), 'path-traversal-test');
+  await expect(bundle!.save(dir)).rejects.toThrow('path traversal');
+});