mirror/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea synced 2026-10-27 14:42:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(javascript): preserve ESM path intent and artifact confinement (#2700)

Browse Source 
* fix(javascript): preserve legacy ESM directory intent

* fix(javascript): normalize legacy ESM URL directory requests

* fix(javascript): retain invalid package URL evidence

* test(apple): bound cold archive fixture compilation

* test(release): scope preflight schema to selected jobs

* fix(javascript): preserve package URL admission and target facts

* fix(javascript): validate package target structure before URL lookup

* fix(javascript): preserve surrogate identity in structural package URLs

* fix(javascript): isolate structural package URL identities

* fix(javascript): resolve paths after opaque ancestors normalize away

* fix(javascript): confine legacy URLs and retain target provenance

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
This commit is contained in:
Rohit Ghumare
2026-10-23 00:04:28 +05:30
committed by GitHub
parent 92a9591a41
commit 6714fb1d02
3 changed files with 89 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/application/javascript/JavaScriptArtifactPathResolution.ts
+15 -4
View File
@@ -1096,10 +1096,19 @@ const resolveLegacyEsmSubpath = (
directory: string,
subpath: string,
): CandidateResolution => {
const declarationRejection = rejectDeclaration(
stripQueryAndFragment(htmlUrlText(subpath)),
);
const subpathPath = stripQueryAndFragment(htmlUrlText(subpath));
const declarationRejection = rejectDeclaration(subpathPath);
if (declarationRejection !== null) return declarationRejection;
let depth = directory === "." ? 0 : directory.split("/").length;
for (const segment of subpathPath.split("/")) {
if (segment === "..") {
if (depth === 0)
return unresolvedCandidate("rejected", [
"The resolved candidate escapes the canonical artifact root.",
]);
depth--;
} else if (segment !== ".") depth++;
}
const metadataUrl = packageMetadataUrl(
posix.join(directory, "package.json"),
subpath,
@@ -1208,7 +1217,9 @@ const resolveExportTarget = (
const candidate = confineCandidate(decoded);
if (typeof candidate !== "string") return withTargetSource(candidate);
if (target.lookupLimitation !== undefined)
return unresolvedCandidate("unavailable", [target.lookupLimitation]);
return withTargetSource(
unresolvedCandidate("unavailable", [target.lookupLimitation]),
);
return (
resolveFileCandidates(input, [candidate]) ??
withTargetSource(exactPackageTargetNotFound(candidate, mapKind))