Repository: microsoft/TypeScript
File: src/compiler/moduleNameResolver.ts (TypeScript)

Code before:

    return packageJsonInfo.contents.resolvedEntrypoints = entrypoints || false;
}

function loadEntrypointsFromExportMap(
    scope: PackageJsonInfo,
    exports: object,
    state: ModuleResolutionState,
    extensions: Extensions,
): PathAndExtension[] | undefined {
    let entrypoints: PathAndExtension[] | undefined;
    if (isArray(exports)) {
        for (const target of exports) {
            loadEntrypointsFromTargetExports(target);
        }
    }
    // eslint-disable-next-line no-null/no-null
    else if (typeof exports === "object" && exports !== null && allKeysStartWithDot(exports as MapLike<unknown>)) {
        for (const key in exports) {
            loadEntrypointsFromTargetExports((exports as MapLike<unknown>)[key]);
        }
    }
    else {
        loadEntrypointsFromTargetExports(exports);
    }
    return entrypoints;

    function loadEntrypointsFromTargetExports(target: unknown): boolean | undefined {
        if (typeof target === "string" && startsWith(target, "./") && target.indexOf("*") === -1) {
            const partsAfterFirst = getPathComponents(target).slice(2);
            if (partsAfterFirst.indexOf("..") >= 0 || partsAfterFirst.indexOf(".") >= 0 || partsAfterFirst.indexOf("node_modules") >= 0) {
                return false;
            }
            const resolvedTarget = combinePaths(scope.packageDirectory, target);
            const finalPath = getNormalizedAbsolutePath(resolvedTarget, state.host.getCurrentDirectory?.());
            const result = loadFileNameFromPackageJsonField(extensions, finalPath, /*onlyRecordFailures*/ false, state);
            if (result) {
                entrypoints = appendIfUnique(entrypoints, result, (a, b) => a.path === b.path);
                return true;
            }
        }
        else if (Array.isArray(target)) {
            for (const t of target) {
                const success = loadEntrypointsFromTargetExports(t);
                if (success) {
                    return true;
                }
            }
        }
        // eslint-disable-next-line no-null/no-null
        else if (typeof target === "object" && target !== null) {

Review comment (security):
I was going to ask if this would be better served as a parameter rather than tacked onto the state, but it does seem like this was already happening given what's in `useCaseSensitiveFileNames`.

Code after:
        const conditionSets = deduplicate(
            [getConditions(options, /*esmMode*/ true), getConditions(options, /*esmMode*/ false)],
            arrayIsEqualTo
        );
        for (const conditions of conditionSets) {
            const loadPackageJsonExportsState = { ...loadPackageJsonMainState, failedLookupLocations: [], conditions, host };
            const exportResolutions = loadEntrypointsFromExportMap(
                packageJsonInfo,
                packageJsonInfo.contents.packageJsonContent.exports,
                loadPackageJsonExportsState,
                extensions);
            if (exportResolutions) {
                for (const resolution of exportResolutions) {
                    entrypoints = appendIfUnique(entrypoints, resolution.path);
                }
            }
        }
    }

    return packageJsonInfo.contents.resolvedEntrypoints = entrypoints || false;
}

function loadEntrypointsFromExportMap(
    scope: PackageJsonInfo,
    exports: object,
    state: ModuleResolutionState & { host: GetPackageJsonEntrypointsHost },
    extensions: Extensions,
): PathAndExtension[] | undefined {
    let entrypoints: PathAndExtension[] | undefined;
    if (isArray(exports)) {
        for (const target of exports) {
            loadEntrypointsFromTargetExports(target);
        }
    }
    // eslint-disable-next-line no-null/no-null
    else if (typeof exports === "object" && exports !== null && allKeysStartWithDot(exports as MapLike<unknown>)) {
        for (const key in exports) {
            loadEntrypointsFromTargetExports((exports as MapLike<unknown>)[key]);
        }
    }
    else {
        loadEntrypointsFromTargetExports(exports);
    }
    return entrypoints;

    function loadEntrypointsFromTargetExports(target: unknown): boolean | undefined {
        if (typeof target === "string" && startsWith(target, "./")) {
            if (target.indexOf("*") >= 0 && state.host.readDirectory) {
                if (target.indexOf("*") !== target.lastIndexOf("*")) {
                    return false;
                }