cli/new: reject absolute template paths

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/cli/src/lib/new/preparation/loadPortableTemplateConfig.test.ts

@@ -243,6 +243,28 @@ describe('loadPortableTemplateConfig', () => {
     );
   });
 
+  it('should throw an error if template point is absolute', async () => {
+    mockDir.setContent({
+      'package.json': JSON.stringify({
+        backstage: {
+          cli: {
+            new: {
+              templates: ['/invalid'],
+            },
+          },
+        },
+      }),
+    });
+
+    await expect(
+      loadPortableTemplateConfig({
+        packagePath: mockDir.resolve('package.json'),
+      }),
+    ).rejects.toThrow(
+      "Failed to load template definition '/invalid'; caused by Error: Template target may not be an absolute path",
+    );
+  });
+
   it('should handle missing backstage.new configuration', async () => {
     mockDir.setContent({
       'package.json': JSON.stringify({}),

packages/cli/src/lib/new/preparation/loadPortableTemplateConfig.ts

@@ -15,7 +15,7 @@
  */
 
 import fs from 'fs-extra';
-import { resolve as resolvePath, dirname } from 'node:path';
+import { resolve as resolvePath, dirname, isAbsolute } from 'node:path';
 import { paths } from '../../paths';
 import { defaultTemplates } from '../defaultTemplates';
 import {
@@ -126,6 +126,10 @@ export async function loadPortableTemplateConfig(
 }
 
 function resolveLocalTemplatePath(pointer: string, basePath: string): string {
+  if (isAbsolute(pointer)) {
+    throw new Error(`Template target may not be an absolute path`);
+  }
+
   if (pointer.startsWith('.')) {
     return resolvePath(basePath, pointer, TEMPLATE_FILE_NAME);
   }