Skip to content

fix: refuse to copy traced files outside the output directory - #1295

Open
cpruijsen wants to merge 2 commits into
opennextjs:mainfrom
cpruijsen:fix/issue-1260-ecc93d74
Open

cpruijsen wants to merge 2 commits into
opennextjs:mainfrom
cpruijsen:fix/issue-1260-ecc93d74

Conversation

@cpruijsen

Copy link
Copy Markdown
Contributor

copyTracedFiles now rejects destinations outside outputDir before the traced-file copy loop.
Dependencies outside the app can produce these destinations, which let the copy loop and later code patches modify source dependencies.

In packages/open-next/src/build/copyTracedFiles.ts, the check covers every queued destination and throws an error with the source and destination paths.
The check runs outside route error handlers, so optional routes cannot suppress the rejection.
Valid destinations inside outputDir/node_modules keep their existing layout.

Nine regression cases for server traces, instrumentation, middleware, ordinary routes, and optional error routes fail without the change and pass with it.
The full Cloudflare reproduction was not run.

Fixes #1260.

@changeset-bot

changeset-bot Bot commented Oct 8, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 3e0db9e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@opennextjs/aws Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-new Bot commented Oct 8, 2026 •

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@opennextjs/aws@1295

commit: 3e0db9e

# Conflicts:
#	packages/tests-unit/tests/build/copyTracedFiles.test.ts

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

copyTracedFiles writes (and patches) files outside .open-next when node_modules resolves outside the app, corrupting the source next package

1 participant