@vercel/build-utils 6.2.0 → 6.2.2

package/dist/fs/glob.js

@@ -32,13 +32,24 @@ async function glob(pattern, opts, mountpoint) {
     const dirs = new Set();
     const dirsWithEntries = new Set();
     for (const relativePath of files) {
-        const fsPath = normalize_path_1.normalizePath(path_1.default.join(options.cwd, relativePath));
+        const absPath = path_1.default.join(options.cwd, relativePath);
+        const fsPath = normalize_path_1.normalizePath(absPath);
         let stat = statCache[fsPath];
         assert_1.default(stat, `statCache does not contain value for ${relativePath} (resolved to ${fsPath})`);
         const isSymlink = symlinks[fsPath];
+        // When `follow` mode is enabled, ensure that the entry is not a symlink
+        // that points to outside of `cwd`
+        if (options.follow &&
+            (isSymlink || (await fs_extra_1.lstat(fsPath)).isSymbolicLink())) {
+            const target = await fs_extra_1.readlink(absPath);
+            const absTarget = path_1.default.resolve(path_1.default.dirname(absPath), target);
+            if (path_1.default.relative(options.cwd, absTarget).startsWith(`..${path_1.default.sep}`)) {
+                continue;
+            }
+        }
         if (isSymlink || stat.isFile() || stat.isDirectory()) {
             if (isSymlink) {
-                stat = await fs_extra_1.lstat(fsPath);
+                stat = await fs_extra_1.lstat(absPath);
             }
             // Some bookkeeping to track which directories already have entries within
             const dirname = path_1.default.dirname(relativePath);

package/dist/index.js

@@ -30744,13 +30744,24 @@ async function glob(pattern, opts, mountpoint) {
     const dirs = new Set();
     const dirsWithEntries = new Set();
     for (const relativePath of files) {
-        const fsPath = normalize_path_1.normalizePath(path_1.default.join(options.cwd, relativePath));
+        const absPath = path_1.default.join(options.cwd, relativePath);
+        const fsPath = normalize_path_1.normalizePath(absPath);
         let stat = statCache[fsPath];
         assert_1.default(stat, `statCache does not contain value for ${relativePath} (resolved to ${fsPath})`);
         const isSymlink = symlinks[fsPath];
+        // When `follow` mode is enabled, ensure that the entry is not a symlink
+        // that points to outside of `cwd`
+        if (options.follow &&
+            (isSymlink || (await fs_extra_1.lstat(fsPath)).isSymbolicLink())) {
+            const target = await fs_extra_1.readlink(absPath);
+            const absTarget = path_1.default.resolve(path_1.default.dirname(absPath), target);
+            if (path_1.default.relative(options.cwd, absTarget).startsWith(`..${path_1.default.sep}`)) {
+                continue;
+            }
+        }
         if (isSymlink || stat.isFile() || stat.isDirectory()) {
             if (isSymlink) {
-                stat = await fs_extra_1.lstat(fsPath);
+                stat = await fs_extra_1.lstat(absPath);
             }
             // Some bookkeeping to track which directories already have entries within
             const dirname = path_1.default.dirname(relativePath);
@@ -31893,7 +31904,7 @@ exports.NodejsLambda = NodejsLambda;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Prerender = void 0;
 class Prerender {
-    constructor({ expiration, lambda, fallback, group, bypassToken, allowQuery, initialHeaders, initialStatus, }) {
+    constructor({ expiration, lambda, fallback, group, bypassToken, allowQuery, initialHeaders, initialStatus, passQuery, }) {
         this.type = 'Prerender';
         this.expiration = expiration;
         this.lambda = lambda;
@@ -31906,6 +31917,13 @@ class Prerender {
             throw new Error('The `group` argument for `Prerender` needs to be a natural number.');
         }
         this.group = group;
+        if (passQuery === true) {
+            this.passQuery = true;
+        }
+        else if (typeof passQuery !== 'boolean' &&
+            typeof passQuery !== 'undefined') {
+            throw new Error(`The \`passQuery\` argument for \`Prerender\` must be a boolean.`);
+        }
         if (bypassToken == null) {
             this.bypassToken = null;
         }

package/dist/prerender.d.ts

@@ -9,6 +9,7 @@ interface PrerenderOptions {
     allowQuery?: string[];
     initialHeaders?: Record<string, string>;
     initialStatus?: number;
+    passQuery?: boolean;
 }
 export declare class Prerender {
     type: 'Prerender';
@@ -20,6 +21,7 @@ export declare class Prerender {
     allowQuery?: string[];
     initialHeaders?: Record<string, string>;
     initialStatus?: number;
-    constructor({ expiration, lambda, fallback, group, bypassToken, allowQuery, initialHeaders, initialStatus, }: PrerenderOptions);
+    passQuery?: boolean;
+    constructor({ expiration, lambda, fallback, group, bypassToken, allowQuery, initialHeaders, initialStatus, passQuery, }: PrerenderOptions);
 }
 export {};

package/dist/prerender.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Prerender = void 0;
 class Prerender {
-    constructor({ expiration, lambda, fallback, group, bypassToken, allowQuery, initialHeaders, initialStatus, }) {
+    constructor({ expiration, lambda, fallback, group, bypassToken, allowQuery, initialHeaders, initialStatus, passQuery, }) {
         this.type = 'Prerender';
         this.expiration = expiration;
         this.lambda = lambda;
@@ -15,6 +15,13 @@ class Prerender {
             throw new Error('The `group` argument for `Prerender` needs to be a natural number.');
         }
         this.group = group;
+        if (passQuery === true) {
+            this.passQuery = true;
+        }
+        else if (typeof passQuery !== 'boolean' &&
+            typeof passQuery !== 'undefined') {
+            throw new Error(`The \`passQuery\` argument for \`Prerender\` must be a boolean.`);
+        }
         if (bypassToken == null) {
             this.bypassToken = null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/build-utils",
-  "version": "6.2.0",
+  "version": "6.2.2",
   "license": "MIT",
   "main": "./dist/index.js",
   "types": "./dist/index.d.js",
@@ -51,5 +51,5 @@
     "typescript": "4.3.4",
     "yazl": "2.5.1"
   },
-  "gitHead": "a585969dd3b77a4ed36d6a2ca11b34f9050489f1"
+  "gitHead": "95a4dcfb33d813f1a0ef18d766232d42c876ce69"
 }