Skip to content

Commit 5550b1e

Browse files
adilburaksenadilburaksen
committed
fix(@angular-devkit/schematics): prevent schematic writes from escaping the workspace via symlinks
The schematics `Tree` and `ScopedHost` confine writes to the workspace only lexically: `_normalizePath` rejects `..` escapes, and `ScopedHost._resolve` joins paths to the workspace root. But the real-filesystem commit (`NodeJsSyncHost.write`/`delete`/`rename`) uses `writeFileSync`/`rmSync`/ `renameSync`, which follow symlinks, with no realpath check. So if a workspace contains a symlinked directory pointing outside it (e.g. from a cloned repo), a built-in schematic or `ng update` migration writing a lexically in-workspace path can create/overwrite/delete a file outside the workspace. This wraps the NodeWorkflow's host so write/delete/rename assert that the real (symlink-resolved) path stays within the workspace root, mirroring the realpath-based restriction already used by the MCP host (`createRootRestrictedHost`). In-workspace operations are unaffected. Verified against the published packages: a real `use-application-builder` migration whose `karmaConfig` resolves through a symlinked directory no longer overwrites the outside target, while the same migration on an in-workspace config still applies.
0 parents  commit 5550b1e

2,049 files changed

Lines changed: 257773 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.bazelrc‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
# Disable NG CLI TTY mode
2+
build --action_env=NG_FORCE_TTY=false
3+
4+
# Required by `rules_ts`.
5+
common --@aspect_rules_ts//ts:skipLibCheck=always
6+
common --@aspect_rules_ts//ts:default_to_tsc_transpiler
7+
8+
# Make TypeScript compilation fast, by keeping a few copies of the compiler
9+
# running as daemons, and cache SourceFile AST's to reduce parse time.
10+
build --strategy=TypeScriptCompile=worker
11+
12+
# Enable debugging tests with --config=debug
13+
test:debug --test_arg=--node_options=--inspect-brk --test_output=streamed --test_strategy=exclusive --test_timeout=9999 --nocache_test_results
14+
15+
# Enable debugging tests with --config=no-sharding
16+
# The below is useful to while using `fit` and `fdescribe` to avoid sharing and re-runs of failed flaky tests.
17+
test:no-sharding --flaky_test_attempts=1 --test_sharding_strategy=disabled
18+
19+
# Frozen lockfile
20+
common --lockfile_mode=error
21+
22+
###############################
23+
# Filesystem interactions #
24+
###############################
25+
26+
# Create symlinks in the project:
27+
# - dist/bin for outputs
28+
# - dist/testlogs, dist/genfiles
29+
# - bazel-out
30+
# NB: bazel-out should be excluded from the editor configuration.
31+
# The checked-in /.vscode/settings.json does this for VSCode.
32+
# Other editors may require manual config to ignore this directory.
33+
# In the past, we saw a problem where VSCode traversed a massive tree, opening file handles and
34+
# eventually a surprising failure with auto-discovery of the C++ toolchain in
35+
# MacOS High Sierra.
36+
# See https://github.com/bazelbuild/bazel/issues/4603
37+
build --symlink_prefix=dist/
38+
39+
# Turn off legacy external runfiles
40+
build --nolegacy_external_runfiles
41+
42+
# Turn on --incompatible_strict_action_env which was on by default
43+
# in Bazel 0.21.0 but turned off again in 0.22.0. Follow
44+
# https://github.com/bazelbuild/bazel/issues/7026 for more details.
45+
# This flag is needed to so that the bazel cache is not invalidated
46+
# when running bazel via `pnpm bazel`.
47+
# See https://github.com/angular/angular/issues/27514.
48+
build --incompatible_strict_action_env
49+
run --incompatible_strict_action_env
50+
test --incompatible_strict_action_env
51+
52+
# Enable remote caching of build/action tree
53+
build --experimental_remote_merkle_tree_cache
54+
55+
# Ensure that tags applied in BUILDs propagate to actions
56+
common --incompatible_allow_tags_propagation
57+
58+
# Ensure sandboxing is enabled even for exclusive tests
59+
test --incompatible_exclusive_test_sandboxed
60+
61+
###############################
62+
# Saucelabs support #
63+
# Turn on these settings with #
64+
# --config=saucelabs #
65+
###############################
66+
67+
# Expose SauceLabs environment to actions
68+
# These environment variables are needed by
69+
# web_test_karma to run on Saucelabs
70+
test:saucelabs --action_env=SAUCE_USERNAME
71+
test:saucelabs --action_env=SAUCE_ACCESS_KEY
72+
test:saucelabs --action_env=SAUCE_READY_FILE
73+
test:saucelabs --action_env=SAUCE_PID_FILE
74+
test:saucelabs --action_env=SAUCE_TUNNEL_IDENTIFIER
75+
test:saucelabs --define=KARMA_WEB_TEST_MODE=SL_REQUIRED
76+
77+
###############################
78+
# Release support #
79+
# Turn on these settings with #
80+
# --config=release #
81+
###############################
82+
83+
# Releases should always be stamped with version control info
84+
# This command assumes node on the path and is a workaround for
85+
# https://github.com/bazelbuild/bazel/issues/4802
86+
build:release --workspace_status_command="pnpm -s ng-dev release build-env-stamp --mode=release"
87+
build:release --stamp
88+
89+
build:snapshot --workspace_status_command="pnpm -s ng-dev release build-env-stamp --mode=snapshot"
90+
build:snapshot --stamp
91+
build:snapshot --//:enable_snapshot_repo_deps
92+
93+
build:e2e --workspace_status_command="pnpm -s ng-dev release build-env-stamp --mode=release"
94+
build:e2e --stamp
95+
test:e2e --test_timeout=3600 --experimental_ui_max_stdouterr_bytes=2097152
96+
97+
# Retry in the event of flakes
98+
test:e2e --flaky_test_attempts=2
99+
100+
build:local --//:enable_package_json_tar_deps
101+
102+
###############################
103+
# Output #
104+
###############################
105+
106+
# A more useful default output mode for bazel query
107+
# Prints eg. "ng_module rule //foo:bar" rather than just "//foo:bar"
108+
query --output=label_kind
109+
110+
# By default, failing tests don't print any output, it goes to the log file
111+
test --test_output=errors
112+
################################
113+
# Remote Execution Setup #
114+
################################
115+
116+
# Use the Angular team internal GCP instance for remote execution.
117+
build:remote --remote_instance_name=projects/internal-200822/instances/primary_instance
118+
build:remote --bes_instance_name=internal-200822
119+
120+
# Starting with Bazel 0.27.0 strategies do not need to be explicitly
121+
# defined. See https://github.com/bazelbuild/bazel/issues/7480
122+
build:remote --define=EXECUTOR=remote
123+
124+
# Setup the remote build execution servers.
125+
build:remote --remote_cache=remotebuildexecution.googleapis.com
126+
build:remote --remote_executor=remotebuildexecution.googleapis.com
127+
build:remote --remote_timeout=600
128+
build:remote --jobs=150
129+
130+
# Setup the toolchain and platform for the remote build execution. The platform
131+
# is provided by the shared dev-infra package and targets k8 remote containers.
132+
build:remote --extra_execution_platforms=@devinfra//bazel/remote-execution:platform_with_network
133+
build:remote --host_platform=@devinfra//bazel/remote-execution:platform_with_network
134+
build:remote --platforms=@devinfra//bazel/remote-execution:platform_with_network
135+
136+
# Set remote caching settings
137+
build:remote --remote_accept_cached=true
138+
build:remote --remote_upload_local_results=false
139+
140+
# Force remote executions to consider the entire run as linux.
141+
# This is required for OSX cross-platform RBE.
142+
build:remote --cpu=k8
143+
build:remote --host_cpu=k8
144+
145+
# Set up authentication mechanism for RBE
146+
build:remote --google_default_credentials
147+
148+
# Use HTTP remote cache
149+
build:remote-cache --remote_cache=https://storage.googleapis.com/angular-team-cache
150+
build:remote-cache --remote_accept_cached=true
151+
build:remote-cache --remote_upload_local_results=false
152+
build:remote-cache --google_default_credentials
153+
154+
# Additional flags added when running a "trusted build" with additional access
155+
build:trusted-build --remote_upload_local_results=true
156+
157+
# Fixes issues with browser archives and files with spaces. Could be
158+
# removed in Bazel 8 when Bazel runfiles supports spaces.
159+
build --experimental_inprocess_symlink_creation
160+
161+
####################################################
162+
# rules_js specific flags
163+
####################################################
164+
165+
# TODO(josephperrott): investigate if this can be removed eventually.
166+
# Prevents the npm package extract from occuring or caching on RBE which overwhelms our quota
167+
build --modify_execution_info=NpmPackageExtract=+no-remote
168+
169+
# Allow the Bazel server to check directory sources for changes. `rules_js` previously
170+
# heavily relied on this, but still uses directory "inputs" in some cases.
171+
# See: https://github.com/aspect-build/rules_js/issues/1408.
172+
startup --host_jvm_args=-DBAZEL_TRACK_SOURCE_DIRECTORIES=1
173+
174+
####################################################
175+
# User bazel configuration
176+
# NOTE: This needs to be the *last* entry in the config.
177+
####################################################
178+
179+
# Load any settings which are specific to the current user. Needs to be *last* statement
180+
# in this config, as the user configuration should be able to overwrite flags from this file.
181+
try-import .bazelrc.user

‎.bazelversion‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
8.7.0

‎.editorconfig‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# https://editorconfig.org
2+
3+
root = true
4+
5+
[*.ts]
6+
charset = utf-8
7+
indent_style = space
8+
indent_size = 2
9+
insert_final_newline = true
10+
spaces_around_brackets = inside
11+
trim_trailing_whitespace = true
12+
quote_type = single
13+
14+
[*.md]
15+
insert_final_newline = false
16+
trim_trailing_whitespace = true

‎.gemini/config.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
have_fun: false
2+
code_review:
3+
disable: false
4+
comment_severity_threshold: MEDIUM
5+
max_review_comments: -1
6+
pull_request_opened:
7+
help: false
8+
summary: false
9+
code_review: true
10+
include_drafts: false
11+
ignore_patterns:
12+
- pnpm-lock.yaml
13+
- CHANGELOG.md

‎.gitattributes‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Auto detect text files and perform LF normalization
2+
* text=auto
3+
4+
# JS and TS files must always use LF for tools to work
5+
*.js eol=lf
6+
*.ts eol=lf
7+
*.json eol=lf
8+
*.css eol=lf
9+
*.scss eol=lf
10+
*.less eol=lf
11+
*.html eol=lf
12+
*.svg eol=lf

‎.github/ISSUE_TEMPLATE/1-bug-report.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Bug report
2+
description: Report a bug in Angular CLI
3+
body:
4+
- type: markdown
5+
attributes:
6+
value: |
7+
Oh hi there!
8+
9+
To expedite issue processing please search open and closed issues before submitting a new one.
10+
Existing issues often contain information about workarounds, resolution, or progress updates.
11+
- type: dropdown
12+
id: command
13+
attributes:
14+
label: Command
15+
description: Can you pin-point the command or commands that are effected by this bug?
16+
options:
17+
- add
18+
- build
19+
- config
20+
- doc
21+
- e2e
22+
- extract-i18n
23+
- generate
24+
- help
25+
- lint
26+
- new
27+
- other
28+
- run
29+
- serve
30+
- test
31+
- update
32+
- version
33+
multiple: true
34+
validations:
35+
required: true
36+
- type: checkboxes
37+
id: is-regression
38+
attributes:
39+
label: Is this a regression?
40+
description: Did this behavior use to work in the previous version?
41+
options:
42+
- label: Yes, this behavior used to work in the previous version
43+
- type: input
44+
id: version-bug-was-not-present
45+
attributes:
46+
label: The previous version in which this bug was not present was
47+
validations:
48+
required: false
49+
- type: textarea
50+
id: description
51+
attributes:
52+
label: Description
53+
description: A clear and concise description of the problem.
54+
validations:
55+
required: true
56+
- type: textarea
57+
id: minimal-reproduction
58+
attributes:
59+
label: Minimal Reproduction
60+
description: |
61+
Simple steps to reproduce this bug.
62+
63+
**Please include:**
64+
* commands run (including args)
65+
* packages added
66+
* related code changes
67+
68+
69+
If reproduction steps are not enough for reproduction of your issue, please create a minimal GitHub repository with the reproduction of the issue.
70+
A good way to make a minimal reproduction is to create a new app via `ng new repro-app` and add the minimum possible code to show the problem.
71+
Share the link to the repo below along with step-by-step instructions to reproduce the problem, as well as expected and actual behavior.
72+
73+
Issues that don't have enough info and can't be reproduced will be closed.
74+
75+
You can read more about issue submission guidelines [here](https://github.com/angular/angular-cli/blob/main/CONTRIBUTING.md#-submitting-an-issue).
76+
validations:
77+
required: true
78+
- type: textarea
79+
id: exception-or-error
80+
attributes:
81+
label: Exception or Error
82+
description: If the issue is accompanied by an exception or an error, please share it below.
83+
render: text
84+
validations:
85+
required: false
86+
- type: textarea
87+
id: environment
88+
attributes:
89+
label: Your Environment
90+
description: Run `ng version` and paste output below.
91+
render: text
92+
validations:
93+
required: true
94+
- type: textarea
95+
id: other
96+
attributes:
97+
label: Anything else relevant?
98+
description: |
99+
Is this a browser specific issue? If so, please specify the browser and version.
100+
Do any of these matter: operating system, IDE, package manager, HTTP server, ...? If so, please mention it below.
101+
validations:
102+
required: false

‎.github/ISSUE_TEMPLATE/2-feature-request.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Feature request
2+
description: Suggest a feature for Angular CLI
3+
body:
4+
- type: markdown
5+
attributes:
6+
value: |
7+
Oh hi there!
8+
9+
To expedite issue processing please search open and closed issues before submitting a new one.
10+
Existing issues often contain information about workarounds, resolution, or progress updates.
11+
- type: dropdown
12+
id: command
13+
attributes:
14+
label: Command
15+
description: Can you pin-point the command or commands that are relevant for this feature request?
16+
options:
17+
- add
18+
- build
19+
- config
20+
- doc
21+
- e2e
22+
- extract-i18n
23+
- generate
24+
- help
25+
- lint
26+
- new
27+
- run
28+
- serve
29+
- test
30+
- update
31+
- version
32+
multiple: true
33+
validations:
34+
required: true
35+
- type: textarea
36+
id: description
37+
attributes:
38+
label: Description
39+
description: A clear and concise description of the problem or missing capability.
40+
validations:
41+
required: true
42+
- type: textarea
43+
id: desired-solution
44+
attributes:
45+
label: Describe the solution you'd like
46+
description: If you have a solution in mind, please describe it.
47+
validations:
48+
required: false
49+
- type: textarea
50+
id: alternatives
51+
attributes:
52+
label: Describe alternatives you've considered
53+
description: Have you considered any alternative solutions or workarounds?
54+
validations:
55+
required: false

0 commit comments

Comments
 (0)