auth0-deploy-cli 8.39.0 → 9.0.0-beta.1

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.0.0-beta.1] - 2026-07-02
+
+### Security
+
+- Prevent path traversal attacks in config file handlers for directory and YAML contexts. [#1418]
+
 ## [8.39.0] - 2026-06-30
 
 ### Added
@@ -1854,7 +1860,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1409]: https://github.com/auth0/auth0-deploy-cli/issues/1409
 [#1411]: https://github.com/auth0/auth0-deploy-cli/issues/1411
 [#1412]: https://github.com/auth0/auth0-deploy-cli/issues/1412
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...HEAD
+[#1418]: https://github.com/auth0/auth0-deploy-cli/issues/1418
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0-beta.1...HEAD
+[9.0.0-beta.1]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v9.0.0-beta.1
 [8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0
 [8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0
 [8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0

package/lib/context/directory/handlers/actionModules.js

@@ -25,15 +25,7 @@ function parse(context) {
             // The `module.code` can be a file path. It needs to be loaded.
             // It can be a relative path, so we need to handle both cases.
             const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${module.code}"]`);
-                module.code = context.loadFile(unixPath, moduleFolder);
-            }
-            else {
-                module.code = context.loadFile(path_1.default.join(context.filePath, module.code), moduleFolder);
-            }
+            module.code = context.loadFile(unixPath, moduleFolder);
         }
         return module;
     });

package/lib/context/directory/handlers/actions.js

@@ -26,17 +26,7 @@ function parse(context) {
         if (action.code) {
             // Convert `action.code` path to Unix-style path by replacing backslashes and multiple slashes with a single forward slash, and remove leading drive letters or './'.
             const unixPath = action.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                // If the Unix-style path exists, load the file from that path
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${action.code}"]`);
-                action.code = context.loadFile(unixPath, actionFolder);
-            }
-            else {
-                // Otherwise, load the file from the context's file path
-                action.code = context.loadFile(path_1.default.join(context.filePath, action.code), actionFolder);
-            }
+            action.code = context.loadFile(unixPath, actionFolder);
         }
         return action;
     });

package/lib/context/directory/handlers/databases.js

@@ -43,9 +43,7 @@ function getDatabase(folder, configRoot, mappingOpts) {
                 const resolvedBase = path_1.default.resolve(configRoot);
                 const toLoad = path_1.default.resolve(folder, script);
                 if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
-                    logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                        `Please update your configuration to use paths relative to the config directory. ` +
-                        `Current absolute path used: ["${script}"]`);
+                    throw new Error(`File reference "${script}" in database custom script "${name}" must be relative to the config directory. Absolute paths and paths outside the config root are not supported.`);
                 }
                 database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(toLoad, mappingOpts);
             }

package/lib/context/directory/index.js

@@ -68,14 +68,12 @@ class DirectoryContext {
         };
     }
     loadFile(f, folder) {
-        const basePath = path.join(this.filePath, folder);
-        let toLoad = path.join(basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const resolvedBase = path.resolve(this.filePath);
+        const inSubfolder = path.resolve(this.filePath, folder, f);
+        const inRoot = path.resolve(this.filePath, f);
+        const toLoad = (0, utils_1.isFile)(inSubfolder) ? inSubfolder : inRoot;
+        if (!toLoad.startsWith(resolvedBase + path.sep)) {
+            throw new Error(`File reference "${f}" must be relative to the config directory. Absolute paths and paths outside the config root are not supported.`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/lib/context/yaml/index.js

@@ -43,15 +43,12 @@ class YAMLContext {
         })();
     }
     loadFile(f) {
-        let toLoad = path_1.default.join(this.basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const resolvedBase = path_1.default.resolve(this.basePath);
+        const toLoad = path_1.default.resolve(this.basePath, f);
+        if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
+            throw new Error(`File reference "${f}" must be relative to the config directory. Absolute paths and paths outside the config root are not supported.`);
         }
-        return (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.resolve(toLoad), {
+        return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,
             disableKeywordReplacement: this.disableKeywordReplacement,
         });

package/lib/tools/auth0/index.js

@@ -11,6 +11,10 @@ const promise_pool_executor_1 = require("promise-pool-executor");
 const client_1 = __importDefault(require("./client"));
 const schema_1 = __importDefault(require("./schema"));
 const handlers_1 = __importDefault(require("./handlers"));
+// Cache the compiled AJV validator to avoid recompiling the schema on every validate() call.
+// Schema compilation is expensive (~5s) due to the complexity of the combined resource schema.
+const ajv = new ajv_1.default({ useDefaults: true, nullable: true });
+const validateSchema = ajv.compile(schema_1.default);
 const calculateDryRunChanges_1 = require("../calculateDryRunChanges");
 const utils_1 = require("../../utils");
 const utils_2 = require("../utils");
@@ -105,13 +109,12 @@ class Auth0 {
         }
     }
     async validate() {
-        const ajv = new ajv_1.default({ useDefaults: true, nullable: true });
         const nonNullAssets = Object.keys(this.assets)
             .filter((k) => this.assets[k] != null)
             .reduce((a, k) => ({ ...a, [k]: this.assets[k] }), {});
-        const valid = ajv.validate(schema_1.default, nonNullAssets);
+        const valid = validateSchema(nonNullAssets);
         if (!valid) {
-            throw new Error(`Schema validation failed loading ${JSON.stringify(ajv.errors, null, 4)}`);
+            throw new Error(`Schema validation failed loading ${JSON.stringify(validateSchema.errors, null, 4)}`);
         }
         await this.runStage('validate');
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.39.0",
+  "version": "9.0.0-beta.1",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {