Merge pull request #6204 from backstage/rugvip/safety

backend-common,cli-common: new utilites for safely resolving child paths

packages/cli/src/lib/bundler/LinkedPackageResolvePlugin.ts

@@ -16,7 +16,7 @@
 
 import { resolve as resolvePath } from 'path';
 import { ResolvePlugin } from 'webpack';
-import { isChildPath } from './paths';
+import { isChildPath } from '@backstage/cli-common';
 import { LernaPackage } from './types';
 
 // Enables proper resolution of packages when linking in external packages.

packages/cli/src/lib/bundler/config.ts

@@ -22,9 +22,10 @@ import ModuleScopePlugin from 'react-dev-utils/ModuleScopePlugin';
 import StartServerPlugin from 'start-server-webpack-plugin';
 import webpack from 'webpack';
 import nodeExternals from 'webpack-node-externals';
+import { isChildPath } from '@backstage/cli-common';
 import { optimization } from './optimization';
 import { Config } from '@backstage/config';
-import { BundlingPaths, isChildPath } from './paths';
+import { BundlingPaths } from './paths';
 import { transforms } from './transforms';
 import { LinkedPackageResolvePlugin } from './LinkedPackageResolvePlugin';
 import { BundlingOptions, BackendBundlingOptions, LernaPackage } from './types';

packages/cli/src/lib/bundler/paths.ts

@@ -15,25 +15,8 @@
  */
 
 import fs from 'fs-extra';
-import path from 'path';
 import { paths } from '../paths';
 
-/**
- * Checks if dir is the same as or a child of base.
- */
-export function isChildPath(base: string, dir: string): boolean {
-  const relativePath = path.relative(base, dir);
-  if (relativePath === '') {
-    // The same directory
-    return true;
-  }
-
-  const outsideBase = relativePath.startsWith('..'); // not outside base
-  const differentDrive = path.isAbsolute(relativePath); // on Windows, this means dir is on a different drive from base.
-
-  return !outsideBase && !differentDrive;
-}
-
 export type BundlingPathsOptions = {
   // bundle entrypoint, e.g. 'src/index'
   entry: string;