Skip to content

Commit

Permalink
fix: Requiring local node files is restricted
Browse files Browse the repository at this point in the history
  • Loading branch information
paveltiunov committed Sep 9, 2019
1 parent df142b1 commit ba3c390
Showing 1 changed file with 9 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -247,10 +247,16 @@ class DataSchemaCompiler {
path.resolve('node_modules', modulePath);

if (absPath.indexOf(nodeModulesPath) !== 0) {
if (this.allowNodeRequire) {
return null;
}
throw new UserError(`'${modulePath}' restricted`);
}
const packagePath = absPath.replace(nodeModulesPath, '').split('/').filter(s => !!s)[0];
if (!packagePath) {
if (this.allowNodeRequire) {
return null;
}
throw new UserError(`'${modulePath}' is incorrect`);
}
if (!this.isWhiteListedPackage(packagePath)) {
Expand All @@ -267,6 +273,9 @@ class DataSchemaCompiler {
}
absPath = path.extname(absPath) !== '.js' ? absPath + '.js' : absPath;
if (!fs.existsSync(absPath)) {
if (this.allowNodeRequire) {
return null;
}
throw new UserError(`Path '${absPath.replace(nodeModulesPath + '/', '')}' not found`);
}
return this.readModuleFile(absPath, errorsReport);
Expand Down

0 comments on commit ba3c390

Please sign in to comment.