fix: prevent directory.bin referencing outside the package root

lib/read-json.js

@@ -348,11 +348,11 @@ function bins (file, data, cb) {
   data = normalizePackageBin(data)
 
   var m = data.directories && data.directories.bin
-  if (data.bin || !m) {
+  if (data.bin || !m || typeof m !== 'string') {
     return cb(null, data)
   }
 
-  m = path.resolve(path.dirname(file), m)
+  m = path.resolve(path.dirname(file), path.join('.', path.join('/', m)))
   glob('**', { cwd: m })
     .then(binsGlob => bins_(file, data, binsGlob, cb))
     .catch(er => cb(er))

test/bin.js

@@ -41,3 +41,25 @@ tap.test('Empty bin test', function (t) {
     t.end()
   })
 })
+
+tap.test('Bin dir test', function (t) {
+  var p = path.resolve(__dirname, 'fixtures/bindir.json')
+  var warn = createWarningCollector()
+  readJson(p, warn, function (er, data) {
+    t.equal(warn.warnings.length, 0)
+    t.equal(data.name, 'bindir-test')
+    t.strictSame(data.bin, { echo: 'bin/echo' })
+    t.end()
+  })
+})
+
+tap.test('Bin dir trim prefix test', function (t) {
+  var p = path.resolve(__dirname, 'fixtures/bindiroutofscope.json')
+  var warn = createWarningCollector()
+  readJson(p, warn, function (er, data) {
+    t.equal(warn.warnings.length, 0)
+    t.equal(data.name, 'bindiroutofscope-test')
+    t.strictSame(data.bin, { echo: 'bin/echo' })
+    t.end()
+  })
+})

test/fixtures/bindir.json

@@ -0,0 +1,14 @@
+{
+  "name": "bindir-test",
+  "description": "my desc",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/npm/read-package-json.git"
+  },
+  "version": "0.0.1",
+  "readme": "hello world",
+  "directories": {
+    "bin": "./bin"
+  },
+  "license": "ISC"
+}

test/fixtures/bindiroutofscope.json

@@ -0,0 +1,14 @@
+{
+  "name": "bindiroutofscope-test",
+  "description": "my desc",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/npm/read-package-json.git"
+  },
+  "version": "0.0.1",
+  "readme": "hello world",
+  "directories": {
+    "bin": "../../../../../bin"
+  },
+  "license": "ISC"
+}