auth0-deploy-cli 9.0.0-beta.1 → 9.0.0-beta.2

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.0.0-beta.2] - 2026-08-11
+
+### Fixed
+
+- Enforce path traversal protection for actions, rules, hooks, and databases. [#1448]
+
 ## [9.0.0-beta.1] - 2026-07-02
 
 ### Security
@@ -1861,7 +1867,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1411]: https://github.com/auth0/auth0-deploy-cli/issues/1411
 [#1412]: https://github.com/auth0/auth0-deploy-cli/issues/1412
 [#1418]: https://github.com/auth0/auth0-deploy-cli/issues/1418
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0-beta.1...HEAD
+[#1448]: https://github.com/auth0/auth0-deploy-cli/issues/1448
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0-beta.2...HEAD
+[9.0.0-beta.2]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0-beta.1...v9.0.0-beta.2
 [9.0.0-beta.1]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v9.0.0-beta.1
 [8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0
 [8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0

package/lib/context/directory/handlers/actionModules.js

@@ -20,12 +20,18 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const moduleFolder = path_1.default.join(tools_1.constants.ACTION_MODULES_DIRECTORY, `${module.name}`);
         if (module.code) {
-            // The `module.code` can be a file path. It needs to be loaded.
-            // It can be a relative path, so we need to handle both cases.
-            const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            module.code = context.loadFile(unixPath, moduleFolder);
+            const normalizedCode = module.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${module.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
+            }
+            module.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return module;
     });

package/lib/context/directory/handlers/actions.js

@@ -22,11 +22,18 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const actionFolder = path_1.default.join(tools_1.constants.ACTIONS_DIRECTORY, `${action.name}`);
         if (action.code) {
-            // Convert `action.code` path to Unix-style path by replacing backslashes and multiple slashes with a single forward slash, and remove leading drive letters or './'.
-            const unixPath = action.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            action.code = context.loadFile(unixPath, actionFolder);
+            const normalizedCode = action.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${action.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
+            }
+            action.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return action;
     });

package/lib/context/directory/handlers/databases.js

@@ -41,9 +41,10 @@ function getDatabase(folder, configRoot, mappingOpts) {
             }
             else {
                 const resolvedBase = path_1.default.resolve(configRoot);
-                const toLoad = path_1.default.resolve(folder, script);
+                const toLoad = path_1.default.resolve(folder, script.replace(/\\/g, '/'));
                 if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
-                    throw new Error(`File reference "${script}" in database custom script "${name}" must be relative to the config directory. Absolute paths and paths outside the config root are not supported.`);
+                    throw new Error(`Path "${script}" resolves to "${toLoad}" which is outside the config directory "${resolvedBase}". ` +
+                        `Move the file inside your config directory.`);
                 }
                 database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(toLoad, mappingOpts);
             }

package/lib/context/directory/handlers/hooks.js

@@ -21,7 +21,17 @@ function parse(context) {
             }),
         };
         if (hook.script) {
-            hook.script = context.loadFile(hook.script, tools_1.constants.HOOKS_DIRECTORY);
+            const normalizedScript = hook.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.HOOKS_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${hook.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
+            }
+            hook.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         hook.name = hook.name.toLowerCase().replace(/\s/g, '-');
         return hook;

package/lib/context/directory/handlers/rules.js

@@ -21,7 +21,17 @@ function parse(context) {
             }),
         };
         if (rule.script) {
-            rule.script = context.loadFile(rule.script, tools_1.constants.RULES_DIRECTORY);
+            const normalizedScript = rule.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.RULES_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${rule.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
+            }
+            rule.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return rule;
     });

package/lib/context/directory/index.js

@@ -68,12 +68,12 @@ class DirectoryContext {
         };
     }
     loadFile(f, folder) {
-        const resolvedBase = path.resolve(this.filePath);
-        const inSubfolder = path.resolve(this.filePath, folder, f);
-        const inRoot = path.resolve(this.filePath, f);
-        const toLoad = (0, utils_1.isFile)(inSubfolder) ? inSubfolder : inRoot;
-        if (!toLoad.startsWith(resolvedBase + path.sep)) {
-            throw new Error(`File reference "${f}" must be relative to the config directory. Absolute paths and paths outside the config root are not supported.`);
+        const configRoot = path.resolve(this.filePath);
+        const basePath = path.resolve(this.filePath, folder);
+        const toLoad = path.resolve(basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path.sep)) {
+            throw new Error(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `Move the file inside your config directory.`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/lib/context/yaml/index.js

@@ -43,10 +43,11 @@ class YAMLContext {
         })();
     }
     loadFile(f) {
-        const resolvedBase = path_1.default.resolve(this.basePath);
-        const toLoad = path_1.default.resolve(this.basePath, f);
-        if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
-            throw new Error(`File reference "${f}" must be relative to the config directory. Absolute paths and paths outside the config root are not supported.`);
+        const configRoot = path_1.default.resolve(this.basePath);
+        const toLoad = path_1.default.resolve(this.basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path_1.default.sep)) {
+            throw new Error(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `Move the file inside your config directory.`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "9.0.0-beta.1",
+  "version": "9.0.0-beta.2",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {