in lib/plugman/pluginHandlers.js [312:333]
function copyFile (plugin_dir, src, project_dir, dest, link) {
src = path.resolve(plugin_dir, src);
if (!fs.existsSync(src)) throw new CordovaError(`"${src}" not found!`);
// check that src path is inside plugin directory
const real_path = fs.realpathSync(src);
const real_plugin_path = fs.realpathSync(plugin_dir);
if (real_path.indexOf(real_plugin_path) !== 0) { throw new CordovaError(`File "${src}" is located outside the plugin directory "${plugin_dir}"`); }
dest = path.resolve(project_dir, dest);
// check that dest path is located in project directory
if (dest.indexOf(project_dir) !== 0) { throw new CordovaError(`Destination "${dest}" for source file "${src}" is located outside the project`); }
fs.mkdirSync(path.dirname(dest), { recursive: true });
if (link) {
linkFileOrDirTree(src, dest);
} else {
fs.cpSync(src, dest, { recursive: true });
}
}