Merge commit from fork

plugins/scaffolder-node/src/actions/fetch.test.ts

@@ -86,6 +86,7 @@ describe('fetchContents helper', () => {
       expect(fs.copy).toHaveBeenCalledWith(
         resolvePath('/some/foo'),
         'somepath',
+        expect.objectContaining({ filter: expect.any(Function) }),
       );
     });
 

plugins/scaffolder-node/src/actions/fetch.ts

@@ -15,7 +15,10 @@
  */
 
 import { UrlReaderService } from '@backstage/backend-plugin-api';
-import { resolveSafeChildPath } from '@backstage/backend-plugin-api';
+import {
+  isChildPath,
+  resolveSafeChildPath,
+} from '@backstage/backend-plugin-api';
 import { InputError } from '@backstage/errors';
 import { ScmIntegrations } from '@backstage/integration';
 import fs from 'fs-extra';
@@ -50,7 +53,7 @@ export async function fetchContents(options: {
   if (!fetchUrlIsAbsolute && baseUrl?.startsWith('file://')) {
     const basePath = baseUrl.slice('file://'.length);
     const srcDir = resolveSafeChildPath(path.dirname(basePath), fetchUrl);
-    await fs.copy(srcDir, outputPath);
+    await fs.copy(srcDir, outputPath, { filter: src => isChildPath(srcDir, src) });
   } else {
     const readUrl = getReadUrl(fetchUrl, baseUrl, integrations);