AIKIDO-2026-549562

TL;DR

The RestrictionsPlugin in enhanced-resolve confines module resolution to configured restrictions paths using an isInside containment check. That check treats a backslash as a path separator on every platform, so on posix systems a resolved path that begins with a restriction string followed by a backslash is accepted even though it names a sibling outside the restricted directory. This lets resolution succeed for files outside the intended boundary, defeating the confinement the restrictions option is meant to enforce. The fix aligns containment with path.win32 and path.posix semantics so a backslash stays an ordinary filename character on posix and the boundary is enforced correctly.