nx 22.7.9 → 22.7.10

package/dist/src/utils/package-json.js

@@ -22,6 +22,7 @@ const target_merging_1 = require("../project-graph/utils/project-configuration/t
 const catalog_1 = require("./catalog");
 const fileutils_1 = require("./fileutils");
 const has_nx_js_plugin_1 = require("./has-nx-js-plugin");
+const path_2 = require("./path");
 const installation_directory_1 = require("./installation-directory");
 const package_manager_1 = require("./package-manager");
 const workspace_root_1 = require("./workspace-root");
@@ -34,15 +35,25 @@ function normalizePackageGroup(packageGroup) {
         }));
 }
 function readNxMigrateConfig(json) {
+    // Registry fetching uses this value to build a temporary extraction path.
+    // Reject unsupported absolute paths and escaping parent traversal before extraction.
+    const assertContained = (migrations) => {
+        if (!(0, path_2.isContainedRelativePath)(migrations)) {
+            throw new Error(`Invalid migrations path "${migrations}" in package "${json.name ?? 'unknown'}@${json.version ?? 'unknown'}": migration paths must not be absolute or escape their base directory through parent traversal.`);
+        }
+        return migrations;
+    };
     const parseNxMigrationsConfig = (fromJson) => {
         if (!fromJson) {
             return {};
         }
         if (typeof fromJson === 'string') {
-            return { migrations: fromJson, packageGroup: [] };
+            return { migrations: assertContained(fromJson), packageGroup: [] };
         }
         return {
-            ...(fromJson.migrations ? { migrations: fromJson.migrations } : {}),
+            ...(fromJson.migrations
+                ? { migrations: assertContained(fromJson.migrations) }
+                : {}),
             ...(fromJson.packageGroup
                 ? { packageGroup: normalizePackageGroup(fromJson.packageGroup) }
                 : {}),

package/dist/src/utils/path.d.ts

@@ -8,6 +8,12 @@ export declare function normalizePath(osSpecificPath: string): string;
  * This should not be used to read files on disk because of the removal of Windows drive letters.
  */
 export declare function joinPathFragments(...fragments: string[]): string;
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+export declare function isContainedRelativePath(relativePath: string): boolean;
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/dist/src/utils/path.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.normalizePath = normalizePath;
 exports.joinPathFragments = joinPathFragments;
+exports.isContainedRelativePath = isContainedRelativePath;
 exports.getCwd = getCwd;
 const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
@@ -23,6 +24,20 @@ function normalizePath(osSpecificPath) {
 function joinPathFragments(...fragments) {
     return normalizePath(path.join(...fragments));
 }
+/**
+ * True when `relativePath` stays inside the directory it is resolved against.
+ * Absolute paths are rejected because `path.join` silently treats them as
+ * relative, so they would otherwise slip past a `..` check.
+ */
+function isContainedRelativePath(relativePath) {
+    if (path.isAbsolute(relativePath)) {
+        return false;
+    }
+    const normalized = path.normalize(relativePath);
+    return !(normalized === '..' ||
+        normalized.startsWith(`..${path.sep}`) ||
+        normalized.startsWith(`..${path.posix.sep}`));
+}
 /**
  * When running a script with the package manager (e.g. `npm run`), the package manager will
  * traverse the directory tree upwards until it finds a `package.json` and will set `process.cwd()`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nx",
-  "version": "22.7.9",
+  "version": "22.7.10",
   "private": false,
   "type": "commonjs",
   "description": "The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration.",
@@ -175,16 +175,16 @@
     }
   },
   "optionalDependencies": {
-    "@nx/nx-darwin-arm64": "22.7.9",
-    "@nx/nx-darwin-x64": "22.7.9",
-    "@nx/nx-freebsd-x64": "22.7.9",
-    "@nx/nx-linux-arm-gnueabihf": "22.7.9",
-    "@nx/nx-linux-arm64-gnu": "22.7.9",
-    "@nx/nx-linux-arm64-musl": "22.7.9",
-    "@nx/nx-linux-x64-gnu": "22.7.9",
-    "@nx/nx-linux-x64-musl": "22.7.9",
-    "@nx/nx-win32-arm64-msvc": "22.7.9",
-    "@nx/nx-win32-x64-msvc": "22.7.9"
+    "@nx/nx-darwin-arm64": "22.7.10",
+    "@nx/nx-darwin-x64": "22.7.10",
+    "@nx/nx-freebsd-x64": "22.7.10",
+    "@nx/nx-linux-arm-gnueabihf": "22.7.10",
+    "@nx/nx-linux-arm64-gnu": "22.7.10",
+    "@nx/nx-linux-arm64-musl": "22.7.10",
+    "@nx/nx-linux-x64-gnu": "22.7.10",
+    "@nx/nx-linux-x64-musl": "22.7.10",
+    "@nx/nx-win32-arm64-msvc": "22.7.10",
+    "@nx/nx-win32-x64-msvc": "22.7.10"
   },
   "nx-migrations": {
     "migrations": "./migrations.json",