ensure we never use node_modules outside of root dir

node_modules/c9/setup_paths.js

@@ -5,13 +5,17 @@
  */
 var modules = require("module");
 var oldResolve = modules._resolveFilename;
-var extraPaths = [
-    __dirname + "/../../"
-];
+var path = require("path")
+var root = path.join(__dirname, "/../..");
+var extraPaths = [ root ];
 modules._resolveFilename = function(request, parent) {
     if (!parent) parent = { paths: [], filename: "" };
     // Ensure client extensions can be loaded
     request = request.replace(/^lib\//, "node_modules/");
+    // ensure we never use node_modules outside of root dir
+    parent.paths = parent.paths.filter(function(p) {
+        return p.indexOf(root) == 0
+    });
     // Add the extra paths
     extraPaths.forEach(function(p) {
         if (parent.paths.indexOf(p) === -1)