Commit af6d4cb
committed
Fix security issue: prevent patching global pnpm store with relative cwd
When --cwd is '.', normalize_lexically returns an empty PathBuf, which
causes strip_prefix to succeed for any path including absolute global
stores. This fix adds a check to reject empty importer paths, preventing
accidental patching of shared global stores used by other projects.1 parent 4e88251 commit af6d4cb
1 file changed
Lines changed: 8 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
310 | 310 | | |
311 | 311 | | |
312 | 312 | | |
| 313 | + | |
| 314 | + | |
| 315 | + | |
313 | 316 | | |
314 | 317 | | |
315 | 318 | | |
| |||
1088 | 1091 | | |
1089 | 1092 | | |
1090 | 1093 | | |
1091 | | - | |
| 1094 | + | |
| 1095 | + | |
| 1096 | + | |
| 1097 | + | |
| 1098 | + | |
1092 | 1099 | | |
1093 | 1100 | | |
1094 | 1101 | | |
| |||
0 commit comments