Fix wildcard package export auto-import containment

Author: scarab-systems

src/compiler/moduleNameResolver.ts

@@ -2306,7 +2306,9 @@ function loadEntrypointsFromExportMap(
                 if (target.indexOf("*") !== target.lastIndexOf("*")) {
                     return false;
                 }
-
+                if (hasInvalidPackageJsonExportTargetSegments(target)) {
+                    return false;
+                }
                 state.host.readDirectory(
                     scope.packageDirectory,
                     extensionsToExtensionsArray(extensions),
@@ -2323,8 +2325,7 @@ function loadEntrypointsFromExportMap(
                 });
             }
             else {
-                const partsAfterFirst = getPathComponents(target).slice(2);
-                if (partsAfterFirst.includes("..") || partsAfterFirst.includes(".") || partsAfterFirst.includes("node_modules")) {
+                if (hasInvalidPackageJsonExportTargetSegments(target)) {
                     return false;
                 }
                 const resolvedTarget = combinePaths(scope.packageDirectory, target);
@@ -2356,6 +2357,13 @@ function loadEntrypointsFromExportMap(
     }
 }
 
+function hasInvalidPackageJsonExportTargetSegments(target: string): boolean {
+    // Package export targets are unrooted paths that begin with "./", so the
+    // first two components are the empty root marker and the leading ".".
+    const partsAfterFirst = getPathComponents(target).slice(2);
+    return partsAfterFirst.includes("..") || partsAfterFirst.includes(".") || partsAfterFirst.includes("node_modules");
+}
+
 /** @internal */
 export function getTemporaryModuleResolutionState(packageJsonInfoCache: PackageJsonInfoCache | undefined, host: ModuleResolutionHost, options: CompilerOptions): ModuleResolutionState {
     return {

src/testRunner/unittests/tsserver/autoImportProvider.ts

@@ -333,6 +333,41 @@ describe("unittests:: tsserver:: autoImportProvider::", () => {
         assert.ok(seenSymbolNames.has("Volume"));
         baselineTsserverLogs("autoImportProvider", "Shared source files between AutoImportProvider and main program", session);
     });
+
+    it("Does not index wildcard export targets outside the package", () => {
+        const files = [
+            {
+                path: "/user/username/projects/project/node_modules/pkg/package.json",
+                content: jsonToReadableText({
+                    name: "pkg",
+                    version: "1.0.0",
+                    exports: {
+                        "./*": "./../../private/*.js",
+                    },
+                }),
+            },
+            { path: "/user/username/projects/project/private/leaked.d.ts", content: `export declare const leakedAutoImport: number;` },
+            { path: "/user/username/projects/project/package.json", content: jsonToReadableText({ dependencies: { pkg: "*" } }) },
+            {
+                path: "/user/username/projects/project/tsconfig.json",
+                content: jsonToReadableText({
+                    compilerOptions: {
+                        module: "nodenext",
+                        lib: ["es5"],
+                    },
+                    files: ["index.ts"],
+                }),
+            },
+            { path: "/user/username/projects/project/index.ts", content: "" },
+        ];
+
+        const { session } = setup(files);
+        openFilesForSession([files[4]], session);
+        const project = session.getProjectService().configuredProjects.get("/user/username/projects/project/tsconfig.json")!;
+        const completions = project.getLanguageService().getCompletionsAtPosition(files[4].path, 0, { includeCompletionsForModuleExports: true });
+        assert.isDefined(completions);
+        assert.isFalse(completions.entries.some(c => c.name === "leakedAutoImport"));
+    });
 });
 
 describe("unittests:: tsserver:: autoImportProvider:: monorepo", () => {