fix(@angular/build): restrict application builder output paths to output directory - #33312
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces path traversal protection by ensuring that generated output files do not escape the configured output directory base. It wraps file emission and deletion processes in try-catch blocks to handle errors gracefully, and implements a robust isSubDirectory utility with corresponding unit and integration tests. The review comments point out a potential issue on Windows environments where using posix.relative directly can fail due to case-insensitive drive letter differences, and suggest using platform-specific relative instead.
d9a1c8a to
323e4a5
Compare
…put directory Ensure all file writes and deletions produced by the application builder are strictly scoped to the configured `outputPath` base directory. This prevents accidental writes and overwrites of files outside of the output directory (e.g. if the `browser` directory option is configured with relative path segments like `..` that escape the base output folder).
323e4a5 to
bd70704
Compare
|
This pull request has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
2 participants
Ensure all file writes and deletions produced by the application builder are strictly scoped to the configured
outputPathbase directory.This prevents accidental writes and overwrites of files outside of the output directory (e.g. if the
browserdirectory option is configured with relative path segments like..that escape the base output folder).