Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Angular CLI can copy files from outside the workspace root through symlinked asset directories

Geschlossen
  • Stimmt etwas nicht?
#34,164 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
52/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
angular, typescript
Bereich
build-system, cli, security

Rechercherichtung

Start by reproducing the six-command example with Angular CLI 22.2.0, then inspect the application builder's asset handling and schema.json, including the schema registry's Ajv setup. Check how symlinked asset directories and the followSymlinks option are passed to globbing. Done means the documented default prevents copying files outside the workspace while explicitly configured behavior remains covered by tests.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

area: @angular/build gemini-triaged
Command

build

Is this a regression?
  • Yes, this behavior used to work in the previous version
The previous version in which this bug was not present was

No response

Description

ng build can copy files from outside the workspace into the build output when an asset directory is a symbolic link.

The application builder checks that every asset path stays inside the workspace root before globbing it:

if (!isSubDirectory(root, entry.input)) {
  throw new Error(`The ${entry.input} asset path must be within the workspace root.`);
}

const cwd = path.resolve(root, entry.input);

const files = await glob(entry.glob, {
  cwd,
  dot: true,
  ignore: entry.ignore ? defaultIgnore.concat(entry.ignore) : defaultIgnore,
  followSymbolicLinks: entry.followSymlinks,
});

That check is lexical. isSubDirectory() resolves both operands with resolve(), compares them with relative(), and never calls realpath:

function isSubDirectory(parent, child) {
  const resolvedParent = resolve(parent);
  const resolvedChild = resolve(parent, child);
  const relativePath = toPosixPath(relative(resolvedParent, resolvedChild));
  return relativePath !== '..' && !relativePath.startsWith('../') && !isAbsolute(relativePath);
}

A symlink inside the project resolves inside the workspace root, passes the check, and is then used as the globber's cwd, which reads through it to the real target.

Whether the globber walks through it depends on followSymlinks, and the value that arrives there is not the documented one. schema.json declares:

"followSymlinks": {
  "type": "boolean",
  "default": false,
  "description": "Allow glob patterns to follow symlink directories. This allows subdirectories of the symlink to be searched."
}

The schema registry builds Ajv without useDefaults:

this._ajv = new ajv.default({
  strict: false,
  loadSchema: (uri) => this._fetch(uri),
  passContext: true,
  verbose: true,
});

so schema defaults are never written into the options object. When the option is not set, entry.followSymlinks is undefined, and tinyglobby treats undefined the same as true:

followSymbolicLinks: undefined  ->  [ 'link/secret.txt' ]
followSymbolicLinks: false      ->  [ ]
followSymbolicLinks: true       ->  [ 'link/secret.txt' ]

The documented default is false. The effective default is true.

The containment check does hold for the direct form, which is what shows it is meant to hold:

assets: [{ "glob": "**/*", "input": "../../../outside" }]

An unhandled exception occurred: The ../../../outside asset path must be within the workspace root.

The same target reached through a symlink is copied with no warning and a successful build.

The configuration ng new generates already globs the whole public/ directory, so angular.json does not need to change:

"assets": [{ "glob": "**/*", "input": "public" }]

A symbolic link is a git object of mode 120000 whose content is a path string, so it survives clone. Nothing is executed during the build, so npm ci --ignore-scripts does not change the outcome.

Minimal Reproduction

See https://github.com/SkyZeroZx/angular-cli-symlink-asset-escape-poc

The same thing reproduces on a stock application in six commands:

npx @angular/[email protected] new repro-app --defaults --skip-git
cd repro-app

mkdir -p /tmp/outside-the-workspace
echo "this file is outside the Angular workspace" > /tmp/outside-the-workspace/secret.txt

ln -s /tmp/outside-the-workspace public/docs

ng build
find dist -name 'secret.txt'

The build completes normally and the file from outside the workspace is in the output:

dist/repro-app/browser/docs/secret.txt

Setting the option to the value the schema already documents as its default stops it:

assets: [{ "glob": "**/*", "input": "public", "followSymlinks": false }]
Exception or Error
Your Environment
Angular CLI 22.2.0
@angular/build 22.2.0
Node.js 24.21.0
npm 10.9.7
Linux x64
tinyglobby 0.2.17
Anything else relevant?

The symlink target can be an absolute path or a relative one such as ../../../.., so it does not need to know the layout of the machine that runs the build.

Vorherrschende Sprache
TypeScript
Sterne
27k
Forks
11.8k
Ø Merge
20 Std. 38 Min.
Gemergte PRs (30 T.)
154

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus angular/angular-cli

Alle Issues in angular/angular-cli

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.