fix(core): validate the migrations path before extracting package migrations - #36887
Open
FrozenPandaz wants to merge 2 commits into
Open
fix(core): validate the migrations path before extracting package migrations#36887FrozenPandaz wants to merge 2 commits into
FrozenPandaz wants to merge 2 commits into
Conversation
…rations `readNxMigrateConfig` now rejects an `nx-migrations.migrations` value that is absolute or escapes its own package, in both the object and string shorthand forms, so the value is validated at the point it is read rather than at each use. The containment check lives in `utils/path.ts` as `isContainedRelativePath` and replaces the duplicate local helper in `prompt-files.ts`. Details supplied privately.
✅ Deploy Preview for nx-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for nx-dev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
View your CI Pipeline Execution ↗ for commit e6b2083
☁️ Nx Cloud last updated this comment at |
![nx-cloud[bot]](https://avatars.githubusercontent.com/in/80458?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Nx Cloud has identified a flaky task in your failed CI:
🔂 Since the failure was identified as flaky, we triggered a CI rerun by adding an empty commit to this branch.
🔔 Heads up, your workspace has pending recommendations ↗ to auto-apply fixes for similar failures.
🎓 Learn more about Self-Healing CI on nx.dev
…rations [Self-Healing CI Rerun]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
readNxMigrateConfigreturned thenx-migrations.migrationsvalue from a package manifest without validating it. Consumers joined that value onto a directory and used the result as a write destination, so the field was trusted to be package-relative without anything enforcing it.The same containment rule was already implemented locally in
prompt-files.tsfor the siblingpromptfield, so there were two copies of the idea and only one of them was applied.Expected Behavior
The value is validated where it is read. A
migrationspath must be relative and must resolve within its own package; anything else fails closed with an error naming the offending package and version. Both the object form and the string shorthand are covered, so every consumer of the field is gated at the point the value is parsed rather than at each use.The containment check now lives in
utils/path.tsasisContainedRelativePathand replaces the duplicate local helper inprompt-files.ts, leaving one rule for the whole migrate path.Related Issue(s)
Security report supplied privately.
View Polygraph session ↗