nx 22.7.7 → 22.7.9

package/dist/src/native/native-file-cache-location.d.ts

@@ -1 +1,17 @@
-export declare function getNativeFileCacheLocation(): string;
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+export declare const NATIVE_CACHE_ROOT: string;
+export declare function getNativeFileCacheLocationToDelete(): string | null;
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+export declare function ensureSecureNativeFileCacheLocation(cacheRoot?: string): string | null;

package/dist/src/native/native-file-cache-location.js

@@ -1,23 +1,97 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getNativeFileCacheLocation = getNativeFileCacheLocation;
-const os_1 = require("os");
+exports.NATIVE_CACHE_ROOT = void 0;
+exports.getNativeFileCacheLocationToDelete = getNativeFileCacheLocationToDelete;
+exports.ensureSecureNativeFileCacheLocation = ensureSecureNativeFileCacheLocation;
 const path_1 = require("path");
-const crypto_1 = require("crypto");
-const workspace_root_1 = require("../utils/workspace-root");
+const fs_1 = require("fs");
+const nx_tmp_dir_1 = require("../utils/nx-tmp-dir");
 const versions_1 = require("../utils/versions");
-function getNativeFileCacheLocation() {
-    if (process.env.NX_NATIVE_FILE_CACHE_DIRECTORY) {
-        return process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+const owned_private_dir_1 = require("../utils/owned-private-dir");
+/**
+ * Path of the current user's native binary cache. Nothing about the constant is
+ * owner-only — `ensureSecureNativeFileCacheLocation` is what establishes that,
+ * and on Windows nothing does, since the OS temp dir is already per-account.
+ */
+exports.NATIVE_CACHE_ROOT = (0, path_1.join)(nx_tmp_dir_1.NX_USER_TMP_DIR, 'native-cache');
+/**
+ * The configured cache dir, normalized. `resolve` strips a trailing slash, which
+ * would otherwise defeat the guards downstream: `lstat` on a path ending in `/`
+ * resolves a symlink rather than reporting it, and `O_NOFOLLOW` then opens the
+ * target. `NX_SOCKET_DIR` is normalized for the same reason.
+ */
+function configuredCacheDir() {
+    const dir = process.env.NX_NATIVE_FILE_CACHE_DIRECTORY;
+    return dir ? (0, path_1.resolve)(dir) : undefined;
+}
+function getNativeFileCacheLocationToDelete() {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        // Checked for ownership before it is handed to a recursive delete: being
+        // configured does not make it ours. Weaker than the load path below, which
+        // also enforces mode and validates the version directory.
+        return (0, owned_private_dir_1.isOwnedRealDirectory)(configured) ? configured : null;
     }
-    else {
-        const hash = (0, crypto_1.createHash)('sha256').update(workspace_root_1.workspaceRoot).update(versions_1.nxVersion);
+    return (0, owned_private_dir_1.isSafeSharedRoot)(nx_tmp_dir_1.NX_TMP_DIR).status === 'ok' &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(nx_tmp_dir_1.NX_USER_TMP_DIR) &&
+        (0, owned_private_dir_1.isOwnedRealDirectory)(exports.NATIVE_CACHE_ROOT)
+        ? (0, path_1.join)(exports.NATIVE_CACHE_ROOT, versions_1.nxVersion)
+        : null;
+}
+/**
+ * Create the native file cache dir, or return `null` if it cannot be created
+ * *securely* — in which case the caller loads the binding in place.
+ *
+ * The stable top-level container is verified as safe for private children. The
+ * uid directory and every directory loaded through are owner-only.
+ * `ensureOwnedPrivateDir` refuses a directory or symlink another local user
+ * planted before us.
+ */
+function ensureSecureNativeFileCacheLocation(
+// Test seam: lets a spec plant a hostile directory under a root it controls.
+cacheRoot = exports.NATIVE_CACHE_ROOT) {
+    const configured = configuredCacheDir();
+    if (configured !== undefined) {
+        const dir = configured;
         try {
-            hash.update((0, os_1.userInfo)().username);
+            // Held to the same 0700 bar as the default location: a `.node` is loaded
+            // out of here. Unlike NX_SOCKET_DIR it is not additionally refused for
+            // naming one of Nx's own roots, which is the only case that throws.
+            (0, fs_1.mkdirSync)((0, path_1.dirname)(dir), { recursive: true });
+            const established = (0, owned_private_dir_1.ensureOwnedPrivateDir)(dir);
+            if (established.status !== 'ok') {
+                // The guard's own reason rather than a fixed sentence: `not-created
+                // (EACCES)` and `foreign-owner` are exactly what the catch below
+                // promises to tell apart, and one string for all of them cannot.
+                throw new owned_private_dir_1.DirectoryRefusedError(established.refusal);
+            }
+            return dir;
         }
         catch (e) {
-            // if there's no user, we only use the workspace root for the hash and move on
+            // Never discard a configured directory silently — the socket directory
+            // follows the same rule. A typo, EACCES or EROFS is otherwise
+            // indistinguishable from a working cache.
+            console.warn(`Nx could not use the configured native file cache directory ${dir} (${e?.code ?? e?.message ?? e}). Loading the native binding in place instead.`);
+            return null;
+        }
+    }
+    const userRoot = (0, path_1.dirname)(cacheRoot);
+    const sharedRoot = (0, path_1.dirname)(userRoot);
+    // Outermost first: the stable shared container must either belong to root or
+    // to us, and must be sticky if peers can write there. The uid directory then
+    // becomes the owner-only boundary for sockets and native-cache alike.
+    if ((0, owned_private_dir_1.ensureSafeSharedRoot)(sharedRoot).status !== 'ok') {
+        return null;
+    }
+    for (const root of [userRoot, cacheRoot]) {
+        if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(root).status !== 'ok') {
+            return null;
         }
-        return (0, path_1.join)((0, os_1.tmpdir)(), `nx-native-file-cache-${hash.digest('hex').substring(0, 7)}`);
     }
+    // Verified, not assumed: this is the directory we load a `.node` out of.
+    const versionDir = (0, path_1.join)(cacheRoot, versions_1.nxVersion);
+    if ((0, owned_private_dir_1.ensureOwnedPrivateDir)(versionDir).status !== 'ok') {
+        return null;
+    }
+    return versionDir;
 }

package/dist/src/project-graph/file-utils.js

@@ -10,6 +10,7 @@ const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const fileutils_1 = require("../utils/fileutils");
+const git_revision_1 = require("../utils/git-revision");
 const ignore_1 = require("../utils/ignore");
 const json_diff_1 = require("../utils/json-diff");
 const workspace_root_1 = require("../utils/workspace-root");
@@ -77,6 +78,9 @@ function calculateFileChanges(files, nxArgs, readFileAtRevision = defaultReadFil
 }
 exports.TEN_MEGABYTES = 1024 * 10000;
 function defaultReadFileAtRevision(file, revision) {
+    if (revision) {
+        (0, git_revision_1.assertValidGitRevision)(revision);
+    }
     try {
         const fileFullPath = `${workspace_root_1.workspaceRoot}${path_1.sep}${file}`;
         const gitRepositoryPath = (0, child_process_1.execSync)('git rev-parse --show-toplevel', {
@@ -89,7 +93,7 @@ function defaultReadFileAtRevision(file, revision) {
             .join('/');
         return !revision
             ? (0, fs_1.readFileSync)(file, 'utf-8')
-            : (0, child_process_1.execSync)(`git show ${revision}:${filePathInGitRepository}`, {
+            : (0, child_process_1.execFileSync)('git', ['show', `${revision}:${filePathInGitRepository}`], {
                 maxBuffer: exports.TEN_MEGABYTES,
                 stdio: ['pipe', 'pipe', 'ignore'],
                 windowsHide: true,

package/dist/src/project-graph/plugins/isolation/isolated-plugin.d.ts

@@ -60,3 +60,4 @@ export declare class IsolatedPlugin implements LoadedNxPlugin {
     shutdown(): void;
     private registerProcessMetrics;
 }
+export declare function getPluginWorkerSocketId(): string;

package/dist/src/project-graph/plugins/isolation/isolated-plugin.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IsolatedPlugin = void 0;
+exports.getPluginWorkerSocketId = getPluginWorkerSocketId;
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 const net_1 = require("net");
 const path = require("path");
 const logger_1 = require("../../../daemon/logger");
@@ -11,6 +13,7 @@ const installation_directory_1 = require("../../../utils/installation-directory"
 const logger_2 = require("../../../utils/logger");
 const progress_topics_1 = require("../../../utils/progress-topics");
 const wait_for_socket_connection_1 = require("../../../utils/wait-for-socket-connection");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const resolve_plugin_1 = require("../resolve-plugin");
 const messaging_1 = require("./messaging");
 const plugin_lifecycle_manager_1 = require("./plugin-lifecycle-manager");
@@ -335,6 +338,10 @@ class IsolatedPlugin {
 exports.IsolatedPlugin = IsolatedPlugin;
 // --- Worker Spawning Utilities ---
 global.nxPluginWorkerCount ??= 0;
+function getPluginWorkerSocketId() {
+    const counter = global.nxPluginWorkerCount++;
+    return `${process.pid}-${counter.toString(36)}-${(0, crypto_1.randomBytes)(4).toString('hex')}`;
+}
 async function startPluginWorker(name) {
     performance.mark(`start-plugin-worker:${name}`);
     const isWorkerTypescript = path.extname(__filename) === '.ts';
@@ -351,12 +358,22 @@ async function startPluginWorker(name) {
             }
             : {}),
     };
-    const ipcPath = (0, socket_utils_1.getPluginOsSocketPath)([process.pid, global.nxPluginWorkerCount++, performance.now()].join('-'));
+    // Keep the host pid readable for diagnostics, the counter collision-free
+    // within this process, and entropy for a reused pid across process runs. The
+    // suffix is a base36 counter plus four random bytes: eleven characters after
+    // the pid until the counter passes 36, and fixed-length where the
+    // `performance.now()` stamp it replaced varied with process uptime. That
+    // keeps the socket path inside the 95-character budget `assertValidSocketPath`
+    // enforces.
+    const ipcPath = (0, socket_utils_1.getPluginOsSocketPath)(getPluginWorkerSocketId());
     const worker = (0, child_process_1.spawn)(process.execPath, [
         ...(isWorkerTypescript ? ['--require', 'ts-node/register'] : []),
         workerPath,
         ipcPath,
         name,
+        // The host's root. The worker validates against this rather than re-resolving,
+        // so the two agree by construction.
+        workspace_root_1.workspaceRoot,
     ], {
         stdio: ['ignore', 'pipe', 'pipe'],
         env,

package/dist/src/project-graph/plugins/isolation/messaging.d.ts

@@ -107,10 +107,23 @@ type PluginMessageDefs = DefineMessages<{
         };
     };
 }>;
+/**
+ * The sender's workspace root. Only the *worker* asserts on it, for host→worker
+ * messages; results and notifications carry the field but the host does not
+ * check it. The daemon channel is checked in the same one direction — the
+ * server validates inbound client messages and the client does not validate
+ * responses — so the two are alike rather than one being weaker.
+ * Optional and stamped centrally in `sendMessageOverSocket`, so the many
+ * message constructors need not set it; undefined is treated as not foreign,
+ * which is why this detects a shared socket directory rather than an attacker.
+ */
+export type WorkspaceStampedMessage = {
+    workspaceRoot?: string;
+};
 /** Union of all plugin worker message types */
-export type PluginWorkerMessage = AllMessages<PluginMessageDefs>;
+export type PluginWorkerMessage = AllMessages<PluginMessageDefs> & WorkspaceStampedMessage;
 /** Union of all plugin worker result types */
-export type PluginWorkerResult = AllResults<PluginMessageDefs>;
+export type PluginWorkerResult = AllResults<PluginMessageDefs> & WorkspaceStampedMessage;
 /** Result type for the load message */
 export type PluginWorkerLoadResult = ResultOf<PluginMessageDefs, 'load'>;
 /**
@@ -122,7 +135,7 @@ export type PluginWorkerEmitLogNotification = {
     type: 'emitLog';
     level: 'log' | 'warn' | 'error';
     message: string;
-};
+} & WorkspaceStampedMessage;
 export type PluginWorkerNotification = PluginWorkerEmitLogNotification;
 export declare function isPluginWorkerNotification(message: Serializable): message is PluginWorkerNotification;
 export declare function isPluginWorkerMessage(message: Serializable): message is PluginWorkerMessage;

package/dist/src/project-graph/plugins/isolation/messaging.js

@@ -7,6 +7,7 @@ exports.consumeMessage = consumeMessage;
 exports.sendMessageOverSocket = sendMessageOverSocket;
 const socket_utils_1 = require("../../../daemon/socket-utils");
 const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
+const workspace_root_1 = require("../../../utils/workspace-root");
 const NOTIFICATION_TYPES = [
     'emitLog',
 ];
@@ -81,6 +82,8 @@ async function consumeMessage(socket, raw, handlers) {
  * Sends a message over the socket with proper formatting.
  */
 function sendMessageOverSocket(socket, message) {
+    // Stamped here rather than in each constructor, mirroring the daemon.
+    message.workspaceRoot = workspace_root_1.workspaceRoot;
     socket.write((0, socket_utils_1.serialize)(message));
     socket.write(consume_messages_from_socket_1.MESSAGE_END_SEQ);
 }

package/dist/src/project-graph/plugins/isolation/plugin-worker.js

@@ -7,6 +7,7 @@ node_perf_hooks_1.performance.mark(`plugin worker ${process.pid} code loading --
 const consume_messages_from_socket_1 = require("../../../utils/consume-messages-from-socket");
 const logger_1 = require("../../../utils/logger");
 const serializable_error_1 = require("../../../utils/serializable-error");
+const daemon_message_1 = require("../../../daemon/message-types/daemon-message");
 const messaging_1 = require("./messaging");
 const worker_streaming_1 = require("./worker-streaming");
 const fs_1 = require("fs");
@@ -22,6 +23,19 @@ global.NX_PLUGIN_WORKER = true;
 let plugin;
 const socketPath = process.argv[2];
 const expectedPluginName = process.argv[3];
+// The host's root, passed explicitly rather than re-resolved: a host that set
+// its root at runtime would resolve a different one here and drop every
+// legitimate message as foreign.
+const hostWorkspaceRoot = process.argv[4];
+// Positional, so inserting an argument host-side shifts all of them — and the
+// symptom is silent and total: an undefined hostWorkspaceRoot makes every
+// message look foreign while the host waits out its plugin timeout.
+if (!socketPath || !expectedPluginName || !hostWorkspaceRoot) {
+    console.error(`[plugin-worker] started with an incomplete argument list ` +
+        `(socketPath=${socketPath}, pluginName=${expectedPluginName}, hostWorkspaceRoot=${hostWorkspaceRoot}). ` +
+        `This is an Nx bug — please report it at https://github.com/nrwl/nx/issues.`);
+    process.exit(1);
+}
 const CONNECT_TIMEOUT_MS = 30_000;
 let connectErrorTimeout = setErrorTimeout(CONNECT_TIMEOUT_MS, `The plugin worker for ${expectedPluginName} is exiting as it was not connected to within ${CONNECT_TIMEOUT_MS / 1000} seconds. ` +
     'Plugin workers expect to receive a socket connection from the parent process shortly after being started. ' +
@@ -44,6 +58,16 @@ const server = (0, net_1.createServer)((socket) => {
         if (!(0, messaging_1.isPluginWorkerMessage)(message)) {
             return;
         }
+        // Same check the daemon applies to its own socket. Dropped rather than thrown:
+        // a stray foreign message must not kill a worker serving its host. The daemon
+        // has a response channel and surfaces it to the client instead.
+        try {
+            (0, daemon_message_1.assertNotForeignWorkspaceMessage)(message, hostWorkspaceRoot, `The Nx plugin worker "${expectedPluginName}" (pid: ${process.pid})`);
+        }
+        catch (e) {
+            logger_1.logger.verbose(`[plugin-worker] ignored a "${message.type}" message: ${e instanceof Error ? e.message : e}`);
+            return;
+        }
         return (0, messaging_1.consumeMessage)(socket, message, {
             load: async ({ plugin: pluginConfiguration, root, name, pluginPath, shouldRegisterTSTranspiler, }) => {
                 loadErrorTimeout?.clear();
@@ -105,8 +129,24 @@ const server = (0, net_1.createServer)((socket) => {
         process.exit(0);
     });
 });
-server.listen(socketPath);
-logger_1.logger.verbose(`[plugin-worker] "${expectedPluginName}" (pid: ${process.pid}) listening on ${socketPath}`);
+server.on('error', (err) => {
+    // Without this the host only sees "exited before the connection was
+    // established"; the errno distinguishes a denied bind from EADDRINUSE.
+    console.error(`[plugin-worker] "${expectedPluginName}" (pid: ${process.pid}) failed to listen on ${socketPath}: ${err.message}`);
+    process.exit(1);
+});
+// A worker killed without its 'end' handler leaves the socket behind. Colliding
+// takes a recycled host pid landing on the same counter *and* the same 4 random
+// bytes; the random component is what this unlink rests on, and on Windows it is
+// the only barrier, since the endpoint is a namespace object and the mode never
+// applies. A failed bind surfaces through the error handler above.
+try {
+    (0, fs_1.unlinkSync)(socketPath);
+}
+catch { }
+server.listen(socketPath, () => {
+    logger_1.logger.verbose(`[plugin-worker] "${expectedPluginName}" (pid: ${process.pid}) listening on ${socketPath}`);
+});
 async function withErrorHandling(cb) {
     try {
         const result = await cb();
@@ -137,15 +177,25 @@ function setErrorTimeout(timeoutMs, errorMessage) {
         },
     };
 }
-const exitHandler = (exitCode) => () => {
+const cleanup = () => {
     server.close();
     try {
         (0, fs_1.unlinkSync)(socketPath);
     }
     catch (e) { }
-    process.exit(exitCode);
 };
-const events = ['SIGINT', 'SIGTERM', 'SIGQUIT', 'exit'];
-events.forEach((event) => process.once(event, exitHandler(0)));
-process.once('uncaughtException', exitHandler(1));
-process.once('unhandledRejection', exitHandler(1));
+const events = ['SIGINT', 'SIGTERM', 'SIGQUIT'];
+events.forEach((event) => process.once(event, () => {
+    cleanup();
+    process.exit(0);
+}));
+// Cleanup only: process.exit() here would override the real exit code.
+process.once('exit', cleanup);
+const fatalHandler = (error) => {
+    // Registering this handler suppresses Node's default reporting.
+    console.error(error);
+    cleanup();
+    process.exit(1);
+};
+process.once('uncaughtException', fatalHandler);
+process.once('unhandledRejection', fatalHandler);

package/dist/src/project-graph/project-graph.js

@@ -350,6 +350,26 @@ async function createProjectGraphAndSourceMapsAsync(opts = {
                 (0, tmp_dir_1.markDaemonAsDisabled)(e.message);
                 return buildProjectGraphAndSourceMapsWithoutDaemon();
             }
+            if (e.daemonPermissionError) {
+                // Deliberately not disabled: unlike the inotify limit above, a socket
+                // owned by someone else stops being there when it is removed or the
+                // machine reboots, and disabling until `nx reset` would outlive the
+                // cause and hide the fix from anyone who followed the advice.
+                // The first line carries the errno, and it is the one token that tells
+                // the two causes apart: EACCES is a socket owned by someone else (delete
+                // it), EPERM is a sandbox refusing the connect syscall (allow unix
+                // sockets under the Nx socket root). The message hedges between exactly
+                // those two because it cannot tell them apart, and this branch does not
+                // call writeDaemonLogs, so dropping the line loses the errno for good.
+                const [summary, ...details] = e.message.split('\n');
+                output_1.output.note({
+                    title: `${summary} Continuing without the daemon.`,
+                    // The blank line after the summary separates paragraphs when the
+                    // message is printed as one blob; as bodyLines it is a leading gap.
+                    bodyLines: details[0] === '' ? details.slice(1) : details,
+                });
+                return buildProjectGraphAndSourceMapsWithoutDaemon();
+            }
             if (e.internalDaemonError) {
                 const errorLogFile = (0, tmp_dir_1.writeDaemonLogs)(e.message);
                 output_1.output.warn({

package/dist/src/utils/command-line-utils.js

@@ -11,6 +11,7 @@ const yargs_parser_1 = tslib_1.__importDefault(require("yargs-parser"));
 const file_utils_1 = require("../project-graph/file-utils");
 const output_1 = require("./output");
 const child_process_1 = require("child_process");
+const git_revision_1 = require("./git-revision");
 const workspace_root_1 = require("./workspace-root");
 const shared_options_1 = require("../command-line/yargs-utils/shared-options");
 function createOverrides(__overrides_unparsed__ = []) {
@@ -192,30 +193,27 @@ function parseFiles(options) {
     }
 }
 function getUncommittedFiles() {
-    return parseGitOutput(`git diff --name-only --no-renames --relative HEAD .`);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        'HEAD',
+        '.',
+    ]);
 }
 function getUntrackedFiles() {
-    return parseGitOutput(`git ls-files --others --exclude-standard`);
+    return parseGitOutput(['ls-files', '--others', '--exclude-standard']);
 }
 function getMergeBase(base, head = 'HEAD') {
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
     try {
-        return (0, child_process_1.execSync)(`git merge-base "${base}" "${head}"`, {
-            maxBuffer: file_utils_1.TEN_MEGABYTES,
-            cwd: workspace_root_1.workspaceRoot,
-            stdio: 'pipe',
-            windowsHide: true,
-        })
-            .toString()
-            .trim();
+        return runGit(['merge-base', base, head]).toString().trim();
     }
     catch {
         try {
-            return (0, child_process_1.execSync)(`git merge-base --fork-point "${base}" "${head}"`, {
-                maxBuffer: file_utils_1.TEN_MEGABYTES,
-                cwd: workspace_root_1.workspaceRoot,
-                stdio: 'pipe',
-                windowsHide: true,
-            })
+            return runGit(['merge-base', '--fork-point', base, head])
                 .toString()
                 .trim();
         }
@@ -225,15 +223,27 @@ function getMergeBase(base, head = 'HEAD') {
     }
 }
 function getFilesUsingBaseAndHead(base, head) {
-    return parseGitOutput(`git diff --name-only --no-renames --relative "${base}" "${head}"`);
+    (0, git_revision_1.assertValidGitRevision)(base);
+    (0, git_revision_1.assertValidGitRevision)(head);
+    return parseGitOutput([
+        'diff',
+        '--name-only',
+        '--no-renames',
+        '--relative',
+        base,
+        head,
+    ]);
 }
-function parseGitOutput(command) {
-    return (0, child_process_1.execSync)(command, {
+function runGit(args) {
+    return (0, child_process_1.execFileSync)('git', args, {
         maxBuffer: file_utils_1.TEN_MEGABYTES,
         cwd: workspace_root_1.workspaceRoot,
         stdio: 'pipe',
         windowsHide: true,
-    })
+    });
+}
+function parseGitOutput(args) {
+    return runGit(args)
         .toString('utf-8')
         .split('\n')
         .map((a) => a.trim())

package/dist/src/utils/git-revision.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+export declare function assertValidGitRevision(revision: string): void;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+export declare function assertValidGitSha(sha: string): void;

package/dist/src/utils/git-revision.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertValidGitRevision = assertValidGitRevision;
+exports.assertValidGitSha = assertValidGitSha;
+/**
+ * Git parses any argument beginning with `-` as an option rather than a
+ * revision, so a flag-shaped revision could smuggle options such as
+ * `--upload-pack` into the git commands Nx runs.
+ */
+function assertValidGitRevision(revision) {
+    if (revision.startsWith('-')) {
+        throw new Error(`Invalid git revision: "${revision}". Git revisions cannot start with "-".`);
+    }
+}
+const COMMIT_SHA = /^[0-9a-f]{7,40}$/i;
+/**
+ * For refs Nx itself recorded from `git rev-parse` and later read back off
+ * disk, where anything other than a commit sha means the value was tampered
+ * with rather than that the user picked an unusual revision.
+ */
+function assertValidGitSha(sha) {
+    if (!COMMIT_SHA.test(sha)) {
+        throw new Error(`Invalid git commit sha: "${sha}". Expected a hexadecimal commit sha.`);
+    }
+}

package/dist/src/utils/git-utils.d.ts

@@ -28,9 +28,7 @@ export declare class GitRepository {
     hasFilterRepoInstalled(): Promise<boolean>;
     filterRepo(source: string, destination: string): Promise<void>;
     filterBranch(source: string, destination: string, branchName: string): Promise<void>;
-    private execAsync;
-    private quotePath;
-    private quoteArg;
+    private execGit;
 }
 export interface VcsRemoteInfo {
     domain: string;