Title: fix(@angular-devkit/schematics): prevent schematic writes from escaping the workspace via symlinks by adilburaksen · Pull Request #33334 · angular/angular-cli · GitHub
Open Graph Title: fix(@angular-devkit/schematics): prevent schematic writes from escaping the workspace via symlinks by adilburaksen · Pull Request #33334 · angular/angular-cli
X Title: fix(@angular-devkit/schematics): prevent schematic writes from escaping the workspace via symlinks by adilburaksen · Pull Request #33334 · angular/angular-cli
Description: Reopens #33325 (the previous PR was accidentally closed; this is the same single-file fix rebased cleanly onto current main). A schematic / migration write can escape the workspace root via a symlinked directory inside the workspace. The schematics NodeWorkflow writes through virtualFs.ScopedHost, whose containment is lexical (it joins the path under the root but does not resolve symlinks), and the schematics Tree only rejects ... So a workspace that contains a symlinked directory can route a write/delete/rename to a file outside the workspace. Fix WorkspaceRootHost extends virtualFs.ScopedHost resolves the real (symlink-collapsed) path with realpathSync (walking up to the first existing ancestor for not-yet-created files) and rejects any write/delete/rename whose real location is outside the workspace root (rel === ".." || rel.startsWith(".." + sep) || isAbsolute(rel)). This mirrors the realpath-based root restriction already used by the MCP host (createRootRestrictedHost). No change for legitimate in-workspace paths. Single file changed: packages/angular_devkit/schematics/tools/workflow/node-workflow.ts (+70 −1).
Open Graph Description: Reopens #33325 (the previous PR was accidentally closed; this is the same single-file fix rebased cleanly onto current main). A schematic / migration write can escape the workspace root via a symli...
X Description: Reopens #33325 (the previous PR was accidentally closed; this is the same single-file fix rebased cleanly onto current main). A schematic / migration write can escape the workspace root via a symli...
Opengraph URL: https://github.com/angular/angular-cli/pull/33334
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:8c4498a7-32e8-1312-e184-d74a5e71e961 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | D0A0:303FF4:3E4B6ED:564D77D:6A60F5CB |
| html-safe-nonce | 10167d5ede21821c55b7d674dfee30f36686641f66f6a5cd5b1e47b79fd016c0 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJEMEEwOjMwM0ZGNDozRTRCNkVEOjU2NEQ3N0Q6NkE2MEY1Q0IiLCJ2aXNpdG9yX2lkIjoiMzQ5MTAyOTI1OTEyMDYwNDYxOSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | ec1bcb1b0dbfed5178a3800d053fa661d6cda21f0c748161d388f7b2460a585b |
| hovercard-subject-tag | pull_request:3834518238 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/angular/angular-cli/pull/33334/files |
| twitter:image | https://avatars.githubusercontent.com/u/56400880?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/56400880?s=400&v=4 |
| og:image:alt | Reopens #33325 (the previous PR was accidentally closed; this is the same single-file fix rebased cleanly onto current main). A schematic / migration write can escape the workspace root via a symli... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 01a0f3379195d313175de239776b09dd4a079d5b2ea29dd9c37e85cd4cd5e990 |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/angular/angular-cli git https://github.com/angular/angular-cli.git |
| octolytics-dimension-user_id | 139426 |
| octolytics-dimension-user_login | angular |
| octolytics-dimension-repository_id | 36891867 |
| octolytics-dimension-repository_nwo | angular/angular-cli |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 36891867 |
| octolytics-dimension-repository_network_root_nwo | angular/angular-cli |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 00ca1a9089c8f2453e5d118d0554c8a26883d159 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width