fix: Sanitized the path to avoid excluding the files

packages/contentstack-export/src/commands/cm/stacks/export.ts

@@ -1,14 +1,14 @@
 import path from 'path';
 import { Command } from '@contentstack/cli-command';
 import {
-  cliux,
   messageHandler,
   printFlagDeprecation,
   managementSDKClient,
   flags,
   ContentstackClient,
   FlagInput,
   pathValidator,
+  sanitizePath,
 } from '@contentstack/cli-utilities';
 import { ModuleExporter } from '../../../export';
 import { setupExportConfig, log, formatError, writeExportMetaFile } from '../../../utils';
@@ -108,7 +108,7 @@ export default class ExportCommand extends Command {
       exportConfig.region = this.region;
       exportConfig.developerHubBaseUrl = this.developerHubUrl;
       if (this.personalizeUrl) exportConfig.modules.personalize.baseURL[exportConfig.region.name] = this.personalizeUrl;
-      exportDir = exportConfig.cliLogsPath || exportConfig.data || exportConfig.exportDir;
+      exportDir = path.resolve(sanitizePath(exportConfig.cliLogsPath || exportConfig.data || exportConfig.exportDir));
       const managementAPIClient: ContentstackClient = await managementSDKClient(exportConfig);
       const moduleExporter = new ModuleExporter(managementAPIClient, exportConfig);
       await moduleExporter.start();

packages/contentstack-export/src/utils/export-config-handler.ts

@@ -1,6 +1,6 @@
 import merge from 'merge';
 import * as path from 'path';
-import { configHandler, isAuthenticated, FlagInput, cliux } from '@contentstack/cli-utilities';
+import { configHandler, isAuthenticated, FlagInput, cliux, sanitizePath } from '@contentstack/cli-utilities';
 import defaultConfig from '../config';
 import { readFile } from './file-helper';
 import { askExportDir, askAPIKey } from './interactive';
@@ -15,8 +15,7 @@ const setupConfig = async (exportCmdFlags: any): Promise<ExportConfig> => {
     const externalConfig = await readFile(exportCmdFlags['config']);
     config = merge.recursive(config, externalConfig);
   }
-  config.exportDir = exportCmdFlags['data'] || exportCmdFlags['data-dir'] || config.data || (await askExportDir());
-
+  config.exportDir = sanitizePath(exportCmdFlags['data'] || exportCmdFlags['data-dir'] || config.data || (await askExportDir()));
   const pattern = /[*$%#<>{}!&?]/g;
   if (pattern.test(config.exportDir)) {
     cliux.print(`\nPlease add a directory path without any of the special characters: (*,&,{,},[,],$,%,<,>,?,!)`, {

packages/contentstack-export/src/utils/logger.ts

@@ -137,7 +137,7 @@ function init(_logPath: string) {
 }
 
 export const log = async (config: ExportConfig, message: any, type: string) => {
-  const logsPath = config.cliLogsPath || config.data;
+  const logsPath = path.resolve(config.cliLogsPath || config.data);
   // ignoring the type argument, as we are not using it to create a logfile anymore
   if (type !== 'error') {
     // removed type argument from init method

packages/contentstack-import-setup/src/utils/import-config-handler.ts

@@ -20,13 +20,13 @@ const setupConfig = async (importCmdFlags: any): Promise<ImportConfig> => {
   //   config = merge.recursive(config, externalConfig);
   // }
 
-  config.contentDir = importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir());
+  config.contentDir = sanitizePath(importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir()));
   const pattern = /[*$%#<>{}!&?]/g;
   if (pattern.test(config.contentDir)) {
     cliux.print(`\nPlease add a directory path without any of the special characters: (*,&,{,},[,],$,%,<,>,?,!)`, {
       color: 'yellow',
     });
-    config.contentDir = await askContentDir();
+    config.contentDir = sanitizePath(await askContentDir());
   }
   config.contentDir = config.contentDir.replace(/['"]/g, '');
   config.contentDir = path.resolve(config.contentDir);

packages/contentstack-import/src/utils/import-config-handler.ts

@@ -20,13 +20,13 @@ const setupConfig = async (importCmdFlags: any): Promise<ImportConfig> => {
     config = merge.recursive(config, externalConfig);
   }
 
-  config.contentDir = importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir());
+  config.contentDir = sanitizePath(importCmdFlags['data'] || importCmdFlags['data-dir'] || config.data || (await askContentDir()));
   const pattern = /[*$%#<>{}!&?]/g;
   if (pattern.test(config.contentDir)) {
     cliux.print(`\nPlease add a directory path without any of the special characters: (*,&,{,},[,],$,%,<,>,?,!)`, {
       color: 'yellow',
     });
-    config.contentDir = await askContentDir();
+    config.contentDir = sanitizePath(await askContentDir());
   }
   config.contentDir = config.contentDir.replace(/['"]/g, '');
   config.contentDir = path.resolve(config.contentDir);

packages/contentstack-import/src/utils/logger.ts

@@ -6,7 +6,6 @@
 
 import * as winston from 'winston';
 import * as path from 'path';
-import mkdirp from 'mkdirp';
 import { ImportConfig } from '../types';
 import { sanitizePath, redactObject } from '@contentstack/cli-utilities';
 
@@ -140,7 +139,7 @@ function init(_logPath: string) {
 }
 
 export const log = async (config: ImportConfig, message: any, type: string) => {
-  config.cliLogsPath = config.cliLogsPath || config.data || path.join(__dirname, 'logs');
+  config.cliLogsPath = sanitizePath(config.cliLogsPath || config.data || path.join(__dirname, 'logs'));
   // ignoring the type argument, as we are not using it to create a logfile anymore
   if (type !== 'error') {
     // removed type argument from init method

packages/contentstack-migrate-rte/package.json

@@ -7,13 +7,13 @@
   "dependencies": {
     "@contentstack/cli-command": "~1.3.3",
     "@contentstack/cli-utilities": "~1.9.0",
-    "@contentstack/json-rte-serializer": "~2.0.11",
+    "@contentstack/json-rte-serializer": "~2.0.12",
     "collapse-whitespace": "^1.1.7",
     "chalk": "^4.1.2",
     "jsdom": "^20.0.3",
-    "jsonschema": "^1.4.1",
+    "jsonschema": "^1.5.0",
     "lodash": "^4.17.21",
-    "nock": "^13.5.5",
+    "nock": "^13.5.6",
     "omit-deep-lodash": "^1.1.7",
     "sinon": "^19.0.2"
   },

packages/contentstack-utilities/src/helpers.ts

@@ -2,6 +2,7 @@ import { checkSync } from 'recheck';
 import traverse from 'traverse';
 import authHandler from './auth-handler';
 import { HttpClient, cliux, configHandler } from '.';
+import { normalize } from 'path';
 export const isAuthenticated = () => authHandler.isAuthenticated();
 export const doesBranchExist = async (stack, branchName) => {
   return stack
@@ -53,8 +54,20 @@ export const validatePath = (input: string) => {
 // To escape special characters in a string
 export const escapeRegExp = (str: string) => str?.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
+const sanitizePathRegex = (str: string) =>
+  str
+    ?.replace(/\\/g, '/') // Convert Windows-style backslashes to forward slashes
+    .replace(/\/+/g, '/') // Collapse multiple slashes into one
+    .replace(/(?:^|\/)\.+(\/|$)/g, '/'); // Remove any `.` or `..` path segments
+
 // To remove the relative path
-export const sanitizePath = (str: string) => str?.replace(/^(\.\.(\/|\\|$))+/, '');
+export const sanitizePath = (str: string) => {
+  const decodedStr = decodeURIComponent(str);
+  return decodedStr
+    ?.replace(/^([\/\\]){2,}/, "./") // Normalize leading slashes/backslashes to ''
+    .replace(/[\/\\]+/g, "/") // Replace multiple slashes/backslashes with a single '/'
+    .replace(/(\.\.(\/|\\|$))+/g, ""); // Remove directory traversal (../ or ..\)
+};
 
 // To validate the UIDs of assets
 export const validateUids = (uid) => /^[a-zA-Z0-9]+$/.test(uid);