@vercel/build-utils - npm Package Compare versions

Comparing version 6.2.1 to 6.2.2

dist/fs/glob.js

@@ -35,9 +35,20 @@ "use strict";
     for (const relativePath of files) {
-        const fsPath = normalize_path_1.normalizePath(path_1.default.join(options.cwd, relativePath));
+        const absPath = path_1.default.join(options.cwd, relativePath);
+        const fsPath = normalize_path_1.normalizePath(absPath);
         let stat = statCache[fsPath];
         assert_1.default(stat, `statCache does not contain value for ${relativePath} (resolved to ${fsPath})`);
         const isSymlink = symlinks[fsPath];
+        // When `follow` mode is enabled, ensure that the entry is not a symlink
+        // that points to outside of `cwd`
+        if (options.follow &&
+            (isSymlink || (await fs_extra_1.lstat(fsPath)).isSymbolicLink())) {
+            const target = await fs_extra_1.readlink(absPath);
+            const absTarget = path_1.default.resolve(path_1.default.dirname(absPath), target);
+            if (path_1.default.relative(options.cwd, absTarget).startsWith(`..${path_1.default.sep}`)) {
+                continue;
+            }
+        }
         if (isSymlink || stat.isFile() || stat.isDirectory()) {
             if (isSymlink) {
-                stat = await fs_extra_1.lstat(fsPath);
+                stat = await fs_extra_1.lstat(absPath);
             }
@@ -44,0 +55,0 @@ // Some bookkeeping to track which directories already have entries within

package.json

 {
   "name": "@vercel/build-utils",
-  "version": "6.2.1",
+  "version": "6.2.2",
   "license": "MIT",
@@ -54,3 +54,3 @@ "main": "./dist/index.js",
   },
-  "gitHead": "c1c8b454cc29de4bd306b87078f36d6416ceb90f"
+  "gitHead": "95a4dcfb33d813f1a0ef18d766232d42c876ce69"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1537989

increased by0.08%

Lines of code

31572

increased by0.07%

No dependency changes