Repository navigation
Reject Windows drive-relative output file names - #6652
Conversation
Names like "C:../../x" are not absolute, but Windows resolves them against the current directory of that drive, which allowed writes outside the output directory.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Thank you for your contribution! ❤️You can try out this pull request locally by installing Rollup via npm install rollup/rollup#fix-windows-drive-relative-file-namesNotice: To build the native dependencies, you need Rustup installed; the required nightly toolchain is then picked up automatically from Or load it into the REPL: https://rollup-o6vxmim6n-rollup-js.vercel.app/repl/?pr=6652 The REPL artefacts are built from commit |
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues block the change strengthening output-directory containment for Windows drive-prefixed file names.
No open issues 🎉
What changed in this PR
This PR strengthens Rollup’s output-directory containment check by rejecting Windows drive-prefixed file names before path normalization, consistently across platforms.
Changes:
- Reject drive-relative names using the existing
FILE_NAME_OUTSIDE_OUTPUT_DIRECTORYerror. - Add regression tests for direct bundle additions, input aliases, and plugin-emitted assets, including traversal paths and lowercase drive letters.
| File | Description |
|---|---|
src/Bundle.ts |
Rejects drive-letter prefixes before normalizing output names. |
test/function/samples/error-file-name-windows-drive-relative/main.js |
Provides the basic drive-relative test entry. |
test/function/samples/error-file-name-windows-drive-relative/_config.js |
Checks rejection of a plugin-added d:x asset. |
test/function/samples/error-file-name-windows-drive-relative-traversal/main.js |
Provides the traversal test entry. |
test/function/samples/error-file-name-windows-drive-relative-traversal/_config.js |
Checks rejection of a drive-relative traversal path. |
test/function/samples/error-file-name-windows-drive-relative-input-alias/main.js |
Provides the input-alias test entry. |
test/function/samples/error-file-name-windows-drive-relative-input-alias/_config.js |
Checks rejection of a drive-relative input alias. |
test/function/samples/error-file-name-windows-drive-relative-emitted-asset/main.js |
Provides the emitted-asset test entry. |
test/function/samples/error-file-name-windows-drive-relative-emitted-asset/_config.js |
Checks rejection of a drive-relative asset emitted through emitFile. |
Review effort: Balanced
Performance report
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #6652 +/- ##
=======================================
Coverage 98.34% 98.34%
=======================================
Files 380 380
Lines 14097 14100 +3
Branches 3019 3020 +1
=======================================
+ Hits 13864 13867 +3
- Misses 190 191 +1
+ Partials 43 42 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
This PR has been released as part of rollup@4.68.2. You can test it via |
This PR contains:
Are tests included?
Breaking Changes?
List any relevant issue numbers:
None.
Description
The output directory containment check rejects
..segments and absolute names such as/x,C:/xandC:\x, but it accepts Windows drive-relative names likeC:../../xorD:x. On Windows these are resolved against the current directory of the given drive, so they can write outsideoutput.dir.The gap is reachable through the same inputs as other output file names:
input: { 'C:../../x': 'main.js' }, which flow into the default[name].jspatternthis.emitFile({ type: 'asset', fileName: 'C:../x.txt' })isFileNameOutsideOutputDirectory()now rejects any name starting with a drive letter. The check runs on the raw name, beforejoin(), because joining such a name on POSIX drops the drive prefix and would hide it. Absolute drive names were already rejected, so this only adds the drive-relative form. On non-Windows platforms, builds that previously wrote a drive-prefixed name as an ordinary file inside the output directory now fail with the existingFILE_NAME_OUTSIDE_OUTPUT_DIRECTORYerror, making behaviour consistent across platforms.