Package map subpath resolves outside the target package directory
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 122k
- Forks
- 37.3k
- Avg merge
- 4d 2h
- Merged PRs (30d)
- 283
Description
Version
v26.5.0
Platform
Subsystem
module
What steps will reproduce the bug?
// package-map.json
{
"packages": {
"app": { "url": "./app", "dependencies": { "dep": "dep" } },
"dep": { "url": "./dep", "dependencies": {} }
}
}
// app/index.js
require('dep/../../secret.js');
node --experimental-package-map ./package-map.json app/index.js
How often does it reproduce? Is there a required condition?
always
What is the expected behavior? Why is that the expected behavior?
Resolution should fail with ERR_INVALID_MODULE_SPECIFIER, because the subpath escapes the target package's own directory (dep) as declared in the package map.
What do you see instead?
The specifier resolves successfully to a file outside the target package directory.
Additional information
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the package-map.json reproduction with app/index.js and node --experimental-package-map. Trace how the dep subpath is resolved when it contains ../../secret.js, and verify that resolution rejects any path outside dep with ERR_INVALID_MODULE_SPECIFIER.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 70/100