Angular CLI can copy files from outside the workspace root through symlinked asset directories

Start by reproducing the six-command example with Angular CLI 22.2.0, then inspect the application builder's asset handling and schema.json, including the schema registry's Ajv setup. Check how symlinked asset directories and the followSymlinks option are passed to globbing. Done means the documented default prevents copying files outside the workspace while explicitly configured behavior remains covered by tests.

Command

build

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

ng build can copy files from outside the workspace into the build output when an asset directory is a symbolic link.

The application builder checks that every asset path stays inside the workspace root before globbing it:

if (!isSubDirectory(root, entry.input)) {
  throw new Error(`The ${entry.input} asset path must be within the workspace root.`);
}

const cwd = path.resolve(root, entry.input);

const files = await glob(entry.glob, {
  cwd,
  dot: true,
  ignore: entry.ignore ? defaultIgnore.concat(entry.ignore) : defaultIgnore,
  followSymbolicLinks: entry.followSymlinks,
});

That check is lexical. isSubDirectory() resolves both operands with resolve(), compares them with relative(), and never calls realpath:

function isSubDirectory(parent, child) {
  const resolvedParent = resolve(parent);
  const resolvedChild = resolve(parent, child);
  const relativePath = toPosixPath(relative(resolvedParent, resolvedChild));
  return relativePath !== '..' && !relativePath.startsWith('../') && !isAbsolute(relativePath);
}

A symlink inside the project resolves inside the workspace root, passes the check, and is then used as the globber's cwd, which reads through it to the real target.

Whether the globber walks through it depends on followSymlinks, and the value that arrives there is not the documented one. schema.json declares:

"followSymlinks": {
  "type": "boolean",
  "default": false,
  "description": "Allow glob patterns to follow symlink directories. This allows subdirectories of the symlink to be searched."
}

The schema registry builds Ajv without useDefaults:

this._ajv = new ajv.default({
  strict: false,
  loadSchema: (uri) => this._fetch(uri),
  passContext: true,
  verbose: true,
});

so schema defaults are never written into the options object. When the option is not set, entry.followSymlinks is undefined, and tinyglobby treats undefined the same as true:

followSymbolicLinks: undefined  ->  [ 'link/secret.txt' ]
followSymbolicLinks: false      ->  [ ]
followSymbolicLinks: true       ->  [ 'link/secret.txt' ]

The documented default is false. The effective default is true.

The containment check does hold for the direct form, which is what shows it is meant to hold:

assets: [{ "glob": "**/*", "input": "../../../outside" }]

An unhandled exception occurred: The ../../../outside asset path must be within the workspace root.

The same target reached through a symlink is copied with no warning and a successful build.

The configuration ng new generates already globs the whole public/ directory, so angular.json does not need to change:

"assets": [{ "glob": "**/*", "input": "public" }]

A symbolic link is a git object of mode 120000 whose content is a path string, so it survives clone. Nothing is executed during the build, so npm ci --ignore-scripts does not change the outcome.

Minimal Reproduction

See https://github.com/SkyZeroZx/angular-cli-symlink-asset-escape-poc

The same thing reproduces on a stock application in six commands:

npx @angular/[email protected] new repro-app --defaults --skip-git
cd repro-app

mkdir -p /tmp/outside-the-workspace
echo "this file is outside the Angular workspace" > /tmp/outside-the-workspace/secret.txt

ln -s /tmp/outside-the-workspace public/docs

ng build
find dist -name 'secret.txt'

The build completes normally and the file from outside the workspace is in the output:

dist/repro-app/browser/docs/secret.txt

Setting the option to the value the schema already documents as its default stops it:

assets: [{ "glob": "**/*", "input": "public", "followSymlinks": false }]

Exception or Error

Your Environment

Angular CLI 22.2.0
@angular/build 22.2.0
Node.js 24.21.0
npm 10.9.7
Linux x64
tinyglobby 0.2.17

Anything else relevant?

The symlink target can be an absolute path or a relative one such as ../../../.., so it does not need to know the layout of the machine that runs the build.