Package map subpath resolves outside the target package directory
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 70/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, node.js
Research direction
Start by running the package-map.json reproduction with app/index.js and node --experimental-package-map. Trace how the dep subpath is resolved when it contains ../../secret.js, and verify that resolution rejects any path outside dep with ERR_INVALID_MODULE_SPECIFIER.
Written by the indexing model from the issue text.
Description
Version
v26.5.0
Platform
Subsystem
module
What steps will reproduce the bug?
// package-map.json
{
"packages": {
"app": { "url": "./app", "dependencies": { "dep": "dep" } },
"dep": { "url": "./dep", "dependencies": {} }
}
}
// app/index.js
require('dep/../../secret.js');
node --experimental-package-map ./package-map.json app/index.js
How often does it reproduce? Is there a required condition?
always
What is the expected behavior? Why is that the expected behavior?
Resolution should fail with ERR_INVALID_MODULE_SPECIFIER, because the subpath escapes the target package's own directory (dep) as declared in the package map.
What do you see instead?
The specifier resolves successfully to a file outside the target package directory.
Additional information
No response
- Dominant language
- JavaScript
- Stars
- 122k
- Forks
- 37.4k
- Avg merge
- 4d 4h
- Merged PRs (30d)
- 276
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nodejs/node
-
doc
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
build
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
feature request
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Similar issues
-
ai-observability bug team/ai-observability
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
AllTheMods/ATM-10-L#19 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
SignalK/n2k-signalk#345 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
JuliaPluto/PlutoPlotly.jl#72 ·