Under the hood
Useful2 Signal3
Plugin file access is now checked against the session root too, and plugins can list files in parent directories.
What's wrong with this entry?
Anonymous. No account, no email.
fs.ancestors
What
File operations from plugins (fs.listDir, fs.exists, fs.stat, writes) now pass the calling plugin's working directory along with the request, and the path check confirms the target sits inside the session root as well as the project root before allowing it. A new fs.ancestors operation lets a plugin ask for named files in the directories above its working directory.
Details
- Path vetting resolves several roots (the dispatch root, its real path, and the real session path) instead of one project root, and both roots are handed to the check for configuration files that have been moved elsewhere.
- Plugins call the new op as
ancestors: (t) => e("fs.ancestors", { names: t.names }). - Neither the operation nor its handler existed in 2.1.246.
Evidence
"fs.ancestors"
Strings lifted out of the shipped bundle, so the claim above can be checked against them.