Generate command should respect file name safety conventions.
- 主要語言
- TypeScript
- 星號
- 27k
- 分支
- 11.8k
- 平均合併
- 14 小時 23 分鐘
- 30 天內合併 PR
- 162
描述
### Command
generate
### Is this a regression?
- [ ] Yes, this behavior used to work in the previous version
### The previous version in which this bug was not present was
_No response_
### Description
Long story short is that the Angular CLI generate or g command is capable of doing some illegal and difficult to reverse file operations.
Longer version: I was going to create a component this morning to make building PrimeNG p-tables simpler and more dynamic. At the time I started, what I was thinking of was specific to a set of tables I intended to use in an administrative context, so I navigated to something like /src/modules/sales/costing-tool/components/templates and typed "ng g c admin-table".
Before I hit enter, I thought about it and decided that rather than creating a module and specific use component that I'd rather make a general use component for generating p-tables dynamically & that it belonged in a shared module rather than a feature module. I thought I'd already deleted the CLI command out of the terminal so without looking I typed cd.. and hit enter. Which was the beginning of a 2+ hour headache that ended up costing me 2 days of work and which potentially could've cost me all the work I've done since May 5.
So the command I effectively entered was "ng g c admin-tablecd..", and what happened is that the CLI was able to somehow dodge the OS level naming safety conventions & it created a folder named admin-tablecd.., which caused there to be an unresolvable reference in my project structure and made it unloadable and unbuildable. And there was nothing I could do to delete the offending folder. I tried deleting it through the UI, using DOS commands, using WSL commands including rmdir with the -rf flag, nothing would get rid of it, even after a reboot. I had just about resolved myself to having to clone my latest remote to a new local repo which would've set me back to the 5th when I tried rmdir with the "\\?\c:\path\to\bad\directory" syntax which finally worked.
I think that optimally the generate command should respect naming safety conventions, or minimally provide a complimentary command to remove generated components.
### Minimal Reproduction
Via the CLI, generate a component with a name that ends in a directory traversal operator, i.e. new-componentcd..
### Exception or Error
```text
The system cannot find the file or directory specified
```
### Your Environment
```text
Angular:
Package Version
------------------------------------------------------
@angular-devkit/architect 0.1502.4
@angular-devkit/core 15.2.4
@angular-devkit/schematics 15.2.4
@schematics/angular 15.2.4
```
### Anything else relevant?
Can't think of anything.
貢獻指南
研究方向
從 Angular CLI 的 `generate` 命令入口點開始,重現以 `cd..` 結尾的回報元件名稱。追蹤該名稱如何變成路徑,然後驗證不安全的名稱在處理時不會建立無法解析的目錄;當最小重現不再產生有問題的路徑時,該 issue 就完成了。
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- angular, typescript
- 領域
- cli
- Issue 類型
- 缺陷
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 停滯
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100