DavidAnson / DavidAnson/markdownlint-cli2
No option to disable following symlinks when resolving globs
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 922
- Forks
- 83
- Avg merge
- 5h 16m
- Merged PRs (30d)
- 21
Description
Description
markdownlint-cli2 resolves file globs via globby, and the internal
globbyOptions object (in markdownlint-cli2.mjs) is hard-coded without a
followSymbolicLinks key, so globby's default (true) always applies.
There's no config option (checked markdownlint-cli2-config-schema.json)
or CLI flag to turn this off.
This is surprising when a project's config lives in a subdirectory that
contains symlinks pointing to files outside that subdirectory (a common
pattern for de-duplicating shared docs across a monorepo). Running
--fix scoped to that subdirectory's glob still follows the symlinks and
writes the fixes through them — silently modifying files outside the
directory the invocation was scoped to, and outside that config's
intended authority.
Minimal reproduction
repo/
├── shared/
│ └── standard.md # owned by a different part of the repo
└── project/
├── .markdownlint-cli2.yaml
└── docs/
└── ref.md -> ../../shared/standard.md # symlink
cd repo/project
markdownlint-cli2 --fix "**/*.md"
If standard.md has a fixable violation (e.g. a missing fenced-code
language, a duplicate blank line), the fix is written to
repo/shared/standard.md through the symlink — even though the
invocation's cwd and glob were scoped entirely to repo/project/.
Expected
Either:
- A documented way to disable symlink-following for glob resolution
(e.g. exposingfollowSymbolicLinks: falsetoglobbyvia a config
or CLI option), or - At minimum, a note in the README calling out that glob resolution
follows symlinks by default and can write outside the invocation's
directory scope, since this isn't obvious from theignores/globs
documentation.
Workaround
Explicitly list every such symlink under ignores in
.markdownlint-cli2.yaml. This works but doesn't scale (has to be kept
in sync by hand with every new symlink) and isn't discoverable — we only
found the issue after --fix had already written into files outside our
directory.
Environment
- markdownlint-cli2: 0.23.2
- markdownlint: 0.41.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in markdownlint-cli2.mjs by inspecting the hard-coded globbyOptions and how configuration and CLI options are handled, then check markdownlint-cli2-config-schema.json and the README. Done means providing a documented way to disable symlink following, or clearly documenting the default behavior and its effects when using --fix.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100