@pnpm/patching.commands 1100.1.4 → 1100.1.5

package/lib/isSubdirectory.d.ts

@@ -0,0 +1,7 @@
+interface PathUtils {
+    isAbsolute: (path: string) => boolean;
+    relative: (from: string, to: string) => string;
+    sep: string;
+}
+export declare function isSubdirectory(parentDir: string, childPath: string, pathUtils?: PathUtils): boolean;
+export {};

package/lib/isSubdirectory.js

@@ -0,0 +1,8 @@
+import path from 'node:path';
+export function isSubdirectory(parentDir, childPath, pathUtils = path) {
+    const relativePath = pathUtils.relative(parentDir, childPath);
+    return relativePath === '' || (relativePath !== '..' &&
+        !relativePath.startsWith(`..${pathUtils.sep}`) &&
+        !pathUtils.isAbsolute(relativePath));
+}
+//# sourceMappingURL=isSubdirectory.js.map

package/lib/patchRemove.js

@@ -7,6 +7,7 @@ import { PnpmError } from '@pnpm/error';
 import { install } from '@pnpm/installing.commands';
 import { pick } from 'ramda';
 import { renderHelp } from 'render-help';
+import { isSubdirectory } from './isSubdirectory.js';
 import { updatePatchedDependencies } from './updatePatchedDependencies.js';
 export function rcOptionsTypes() {
     return pick([], allTypes);
@@ -25,7 +26,7 @@ export function help() {
 }
 export async function handler(opts, params) {
     let patchesToRemove = params;
-    const patchedDependencies = opts.patchedDependencies ?? {};
+    const patchedDependencies = { ...opts.patchedDependencies };
     if (!params.length) {
         const allPatches = Object.keys(patchedDependencies);
         if (allPatches.length) {
@@ -56,15 +57,19 @@ export async function handler(opts, params) {
             throw new PnpmError('PATCH_NOT_FOUND', `Patch "${patch}" not found in patched dependencies`);
         }
     }
-    const patchesDirs = new Set();
-    await Promise.all(patchesToRemove.map(async (patch) => {
-        if (Object.hasOwn(patchedDependencies, patch)) {
-            const patchFile = patchedDependencies[patch];
-            patchesDirs.add(path.dirname(patchFile));
-            await fs.rm(patchFile, { force: true });
-            delete patchedDependencies[patch];
+    const patchRemovalContext = await getPatchRemovalContext(opts);
+    const patchesToRemoveTargets = await Promise.all(patchesToRemove.map(async (patch) => {
+        const patchFile = patchedDependencies[patch];
+        if (patchFile == null) {
+            throw new PnpmError('PATCH_NOT_FOUND', `Patch "${patch}" not found in patched dependencies`);
         }
+        return getPatchRemovalTarget(patch, patchFile, patchRemovalContext);
     }));
+    await Promise.all(patchesToRemoveTargets.map(unlinkPatchIfExists));
+    for (const { patch } of patchesToRemoveTargets) {
+        delete patchedDependencies[patch];
+    }
+    const patchesDirs = new Set(patchesToRemoveTargets.map(({ parentDir }) => parentDir));
     await Promise.all(Array.from(patchesDirs).map(async (dir) => {
         try {
             const files = await fs.readdir(dir);
@@ -78,6 +83,88 @@ export async function handler(opts, params) {
         ...opts,
         workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir,
     });
-    return install.handler(opts);
+    return install.handler({
+        ...opts,
+        patchedDependencies,
+    });
+}
+async function getPatchRemovalContext(opts) {
+    const lockfileDir = path.resolve(opts.lockfileDir ?? opts.dir ?? process.cwd());
+    const realLockfileDir = await fs.realpath(lockfileDir);
+    const patchesDirSetting = opts.patchesDir ?? 'patches';
+    const patchesDir = path.join(lockfileDir, path.normalize(patchesDirSetting));
+    if (!isSubdirectory(lockfileDir, patchesDir)) {
+        throw new PnpmError('PATCHES_DIR_OUTSIDE_PROJECT', `The configured patches directory is outside the project: ${patchesDirSetting}`);
+    }
+    const realPatchesDir = await realpathIfExists(patchesDir);
+    if (realPatchesDir != null && !isSubdirectory(realLockfileDir, realPatchesDir)) {
+        throw new PnpmError('PATCHES_DIR_OUTSIDE_PROJECT', `The configured patches directory is outside the project: ${patchesDirSetting}`);
+    }
+    return {
+        lockfileDir,
+        patchesDir,
+        realPatchesDir,
+    };
+}
+async function getPatchRemovalTarget(patch, patchFile, ctx) {
+    const targetPath = path.resolve(ctx.lockfileDir, patchFile);
+    if (targetPath === ctx.patchesDir ||
+        !isSubdirectory(ctx.patchesDir, targetPath)) {
+        throw new PnpmError('PATCH_FILE_OUTSIDE_PATCHES_DIR', `Patch file "${patchFile}" is outside the configured patches directory`);
+    }
+    const parentDir = path.dirname(targetPath);
+    const targetStats = await lstatIfExists(targetPath);
+    const realParentDir = await realpathIfExists(parentDir);
+    const realPatchesDir = ctx.realPatchesDir ?? (await realpathIfExists(ctx.patchesDir));
+    if (realParentDir != null &&
+        realPatchesDir != null &&
+        !isSubdirectory(realPatchesDir, realParentDir)) {
+        throw new PnpmError('PATCH_FILE_OUTSIDE_PATCHES_DIR', `Patch file "${patchFile}" is outside the configured patches directory`);
+    }
+    if (targetStats?.isDirectory()) {
+        throw new PnpmError('PATCH_FILE_IS_DIRECTORY', `Patch file "${patchFile}" is a directory`);
+    }
+    return {
+        patch,
+        patchFile,
+        parentDir,
+        targetPath,
+        targetExists: targetStats != null,
+    };
+}
+async function unlinkPatchIfExists({ targetExists, targetPath }) {
+    if (!targetExists)
+        return;
+    try {
+        await fs.unlink(targetPath);
+    }
+    catch (err) {
+        if (isErrorWithCode(err, 'ENOENT'))
+            return;
+        throw err;
+    }
+}
+async function lstatIfExists(targetPath) {
+    try {
+        return await fs.lstat(targetPath);
+    }
+    catch (err) {
+        if (isErrorWithCode(err, 'ENOENT'))
+            return undefined;
+        throw err;
+    }
+}
+async function realpathIfExists(targetPath) {
+    try {
+        return await fs.realpath(targetPath);
+    }
+    catch (err) {
+        if (isErrorWithCode(err, 'ENOENT'))
+            return undefined;
+        throw err;
+    }
+}
+function isErrorWithCode(err, code) {
+    return typeof err === 'object' && err !== null && 'code' in err && err.code === code;
 }
 //# sourceMappingURL=patchRemove.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/patching.commands",
-  "version": "1100.1.4",
+  "version": "1100.1.5",
   "description": "Commands for creating patches",
   "keywords": [
     "pnpm",
@@ -38,35 +38,35 @@
     "realpath-missing": "^2.0.0",
     "render-help": "^2.0.0",
     "safe-execa": "^0.3.0",
-    "semver": "^7.8.1",
+    "semver": "^7.8.4",
     "terminal-link": "^5.0.0",
     "tinyglobby": "^0.2.16",
-    "@pnpm/config.writer": "1100.0.12",
-    "@pnpm/cli.utils": "1101.0.11",
-    "@pnpm/crypto.hash": "1100.0.1",
-    "@pnpm/error": "1100.0.0",
+    "@pnpm/config.reader": "1101.9.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/config.reader": "1101.8.0",
+    "@pnpm/config.writer": "1100.0.13",
+    "@pnpm/crypto.hash": "1100.0.1",
     "@pnpm/fs.packlist": "1100.0.1",
-    "@pnpm/fetching.pick-fetcher": "1100.0.11",
-    "@pnpm/installing.commands": "1100.8.0",
-    "@pnpm/installing.modules-yaml": "1100.0.8",
-    "@pnpm/lockfile.fs": "1100.1.4",
-    "@pnpm/lockfile.utils": "1100.0.12",
-    "@pnpm/patching.apply-patch": "1100.0.1",
+    "@pnpm/installing.commands": "1100.9.0",
+    "@pnpm/installing.modules-yaml": "1100.0.9",
+    "@pnpm/cli.utils": "1101.0.12",
+    "@pnpm/lockfile.utils": "1100.0.13",
+    "@pnpm/patching.apply-patch": "1100.0.2",
+    "@pnpm/pkg-manifest.reader": "1100.0.8",
     "@pnpm/resolving.parse-wanted-dependency": "1100.0.1",
-    "@pnpm/store.connection-manager": "1100.2.8",
-    "@pnpm/types": "1101.3.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.12",
+    "@pnpm/store.connection-manager": "1100.3.0",
     "@pnpm/store.path": "1100.0.1",
-    "@pnpm/workspace.workspace-manifest-reader": "1100.0.7",
-    "@pnpm/pkg-manifest.reader": "1100.0.7"
+    "@pnpm/types": "1101.3.2",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
+    "@pnpm/workspace.workspace-manifest-reader": "1100.0.8",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/fetching.pick-fetcher": "1100.0.12",
+    "@pnpm/lockfile.fs": "1100.1.5"
   },
   "peerDependencies": {
-    "@pnpm/logger": "^1001.0.1"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
     "@types/is-windows": "^1.0.2",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
@@ -74,12 +74,12 @@
     "tempy": "3.0.0",
     "write-yaml-file": "^6.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/prepare": "1100.0.15",
-    "@pnpm/patching.commands": "1100.1.4",
-    "@pnpm/testing.command-defaults": "1100.0.5",
-    "@pnpm/workspace.projects-filter": "1100.0.20",
-    "@pnpm/testing.registry-mock": "1100.0.5",
-    "@pnpm/test-fixtures": "1100.0.0"
+    "@pnpm/patching.commands": "1100.1.5",
+    "@pnpm/prepare": "1100.0.16",
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/testing.command-defaults": "1100.0.6",
+    "@pnpm/testing.registry-mock": "1100.0.6",
+    "@pnpm/workspace.projects-filter": "1100.0.21"
   },
   "engines": {
     "node": ">=22.13"