From 6727da4fd278a85c80c5b93ebea5f3230e25934e Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Sun, 4 Jun 2017 18:01:51 +0300 Subject: [PATCH 01/14] Allow importing package.json --- packages/react-dev-utils/ModuleScopePlugin.js | 15 +++++++++------ packages/react-scripts/template/src/App.js | 2 ++ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index adc9bdcba93..e82831372ee 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -37,10 +37,14 @@ class ModuleScopePlugin { // Maybe an indexOf === 0 would be better? const relative = path.relative(appSrc, request.context.issuer); // If it's not in src/ or a subdirectory, not our request! - if ( - relative.startsWith('../') || - relative.startsWith('..\\') - ) { + if (relative.startsWith('../') || relative.startsWith('..\\')) { + return callback(); + } + const descriptionFileRelativeToRoot = path.relative( + request.descriptionFileRoot, + request.descriptionFilePath + ); + if (descriptionFileRelativeToRoot === 'package.json') { return callback(); } // Find path from src to the requested file @@ -53,8 +57,7 @@ class ModuleScopePlugin { ); // Error if in a parent directory of src/ if ( - requestRelative.startsWith('../') || - requestRelative.startsWith('..\\') + requestRelative.startsWith('../') || requestRelative.startsWith('..\\') ) { callback( new Error( diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index d7d52a7f38a..9dc2e237928 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,6 +1,7 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; +import { version, name } from '../../package.json'; class App extends Component { render() { @@ -9,6 +10,7 @@ class App extends Component {
logo

Welcome to React

+

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From d22a9df67b31a5051552287c9f29f83579c0bf4f Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Sun, 4 Jun 2017 18:23:19 +0300 Subject: [PATCH 02/14] Remove package.json import from App.js template --- packages/react-scripts/template/src/App.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index 9dc2e237928..d7d52a7f38a 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,7 +1,6 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; -import { version, name } from '../../package.json'; class App extends Component { render() { @@ -10,7 +9,6 @@ class App extends Component {

logo

Welcome to React

-

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From 9ef9fcb4189520b2e0fe515366e8bc2f27934299 Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 22 Jun 2017 22:53:03 +0300 Subject: [PATCH 03/14] fix importing package.json --- packages/react-dev-utils/ModuleScopePlugin.js | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index e82831372ee..3d9320c7d60 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -40,21 +40,19 @@ class ModuleScopePlugin { if (relative.startsWith('../') || relative.startsWith('..\\')) { return callback(); } + const requestFullPath = path.resolve( + path.dirname(request.context.issuer), + request.__innerRequest_request + ); const descriptionFileRelativeToRoot = path.relative( request.descriptionFileRoot, - request.descriptionFilePath + requestFullPath ); if (descriptionFileRelativeToRoot === 'package.json') { return callback(); } // Find path from src to the requested file - const requestRelative = path.relative( - appSrc, - path.resolve( - path.dirname(request.context.issuer), - request.__innerRequest_request - ) - ); + const requestRelative = path.relative(appSrc, requestFullPath); // Error if in a parent directory of src/ if ( requestRelative.startsWith('../') || requestRelative.startsWith('..\\') From d382a94d10a4c0cb366072a719449173410bb3cb Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 22 Jun 2017 23:01:48 +0300 Subject: [PATCH 04/14] Rename variable to reflect path is relative to root --- packages/react-dev-utils/ModuleScopePlugin.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index 3d9320c7d60..c65407e0ca3 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -44,11 +44,11 @@ class ModuleScopePlugin { path.dirname(request.context.issuer), request.__innerRequest_request ); - const descriptionFileRelativeToRoot = path.relative( + const requestRelativeToRoot = path.relative( request.descriptionFileRoot, requestFullPath ); - if (descriptionFileRelativeToRoot === 'package.json') { + if (requestRelativeToRoot === 'package.json') { return callback(); } // Find path from src to the requested file From 18ee2fc133858ef398eb0653e4b03e72aad3177d Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 22 Jun 2017 23:11:57 +0300 Subject: [PATCH 05/14] Check for both package & package.json in ModuleScopePlugin --- packages/react-dev-utils/ModuleScopePlugin.js | 5 ++++- packages/react-scripts/template/src/App.js | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index c65407e0ca3..24263e21e77 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -48,7 +48,10 @@ class ModuleScopePlugin { request.descriptionFileRoot, requestFullPath ); - if (requestRelativeToRoot === 'package.json') { + if ( + requestRelativeToRoot === 'package.json' || + requestRelativeToRoot === 'package' + ) { return callback(); } // Find path from src to the requested file diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index d7d52a7f38a..9dc2e237928 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,6 +1,7 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; +import { version, name } from '../../package.json'; class App extends Component { render() { @@ -9,6 +10,7 @@ class App extends Component {

logo

Welcome to React

+

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From be60e23db7b0cc66667db5dfab26323871e1ecf7 Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 22 Jun 2017 23:56:46 +0300 Subject: [PATCH 06/14] Use regex to check relative path to package.json --- packages/react-dev-utils/ModuleScopePlugin.js | 11 ++--------- packages/react-scripts/template/src/App.js | 2 -- 2 files changed, 2 insertions(+), 11 deletions(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index 24263e21e77..bec33107909 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -44,18 +44,11 @@ class ModuleScopePlugin { path.dirname(request.context.issuer), request.__innerRequest_request ); - const requestRelativeToRoot = path.relative( - request.descriptionFileRoot, - requestFullPath - ); - if ( - requestRelativeToRoot === 'package.json' || - requestRelativeToRoot === 'package' - ) { + const requestRelative = path.relative(appSrc, requestFullPath); + if (/^(..[/|\\])+package(.json)?$/.test(requestRelative)) { return callback(); } // Find path from src to the requested file - const requestRelative = path.relative(appSrc, requestFullPath); // Error if in a parent directory of src/ if ( requestRelative.startsWith('../') || requestRelative.startsWith('..\\') diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index 9dc2e237928..d7d52a7f38a 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,7 +1,6 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; -import { version, name } from '../../package.json'; class App extends Component { render() { @@ -10,7 +9,6 @@ class App extends Component {

logo

Welcome to React

-

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From c288ecabf9dae7489d96fce9589e9ac56baac4e1 Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 29 Jun 2017 16:06:32 +0300 Subject: [PATCH 07/14] Strictly enforce package.json extension on scope plugin --- packages/react-dev-utils/ModuleScopePlugin.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index bec33107909..e4c5f0901b2 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -45,7 +45,7 @@ class ModuleScopePlugin { request.__innerRequest_request ); const requestRelative = path.relative(appSrc, requestFullPath); - if (/^(..[/|\\])+package(.json)?$/.test(requestRelative)) { + if (/^(..[/|\\])+package\.json$/.test(requestRelative)) { return callback(); } // Find path from src to the requested file From ee51957a75221ba2c355c77907b1faf3c6f957d0 Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 29 Jun 2017 16:23:58 +0300 Subject: [PATCH 08/14] Add allowedPaths to ModuleScopePlugin ctor and use it to allow app package.json --- packages/react-dev-utils/ModuleScopePlugin.js | 10 ++++++---- packages/react-dev-utils/README.md | 4 ++-- packages/react-scripts/config/webpack.config.dev.js | 2 +- packages/react-scripts/config/webpack.config.prod.js | 2 +- packages/react-scripts/template/src/App.js | 2 ++ 5 files changed, 12 insertions(+), 8 deletions(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index 1e365a417d9..a582c9bcdbf 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -13,8 +13,9 @@ const chalk = require('chalk'); const path = require('path'); class ModuleScopePlugin { - constructor(appSrc) { + constructor(appSrc, allowedPaths) { this.appSrc = appSrc; + this.allowedPaths = new Set(allowedPaths); } apply(resolver) { @@ -44,14 +45,15 @@ class ModuleScopePlugin { path.dirname(request.context.issuer), request.__innerRequest_request ); - const requestRelative = path.relative(appSrc, requestFullPath); - if (/^(..[/|\\])+package\.json$/.test(requestRelative)) { + if (this.allowedPaths.has(requestFullPath)) { return callback(); } // Find path from src to the requested file // Error if in a parent directory of src/ + const requestRelative = path.relative(appSrc, requestFullPath); if ( - requestRelative.startsWith('../') || requestRelative.startsWith('..\\') + requestRelative.startsWith('../') || + requestRelative.startsWith('..\\') ) { callback( new Error( diff --git a/packages/react-dev-utils/README.md b/packages/react-dev-utils/README.md index 166e1bfaea3..e31ae492c86 100644 --- a/packages/react-dev-utils/README.md +++ b/packages/react-dev-utils/README.md @@ -57,7 +57,7 @@ module.exports = { ``` -#### `new ModuleScopePlugin(appSrc: string)` +#### `new ModuleScopePlugin(appSrc: string, allowedPaths: [string])` This Webpack plugin ensures that relative imports from app's source directory don't reach outside of it. @@ -71,7 +71,7 @@ module.exports = { resolve: { // ... plugins: [ - new ModuleScopePlugin(paths.appSrc), + new ModuleScopePlugin(paths.appSrc, [paths.appPackageJson]), // ... ], // ... diff --git a/packages/react-scripts/config/webpack.config.dev.js b/packages/react-scripts/config/webpack.config.dev.js index 987e7a3570c..21047d2e24f 100644 --- a/packages/react-scripts/config/webpack.config.dev.js +++ b/packages/react-scripts/config/webpack.config.dev.js @@ -117,7 +117,7 @@ module.exports = { // To fix this, we prevent you from importing files out of src/ -- if you'd like to, // please link the files into your node_modules/ and let module-resolution kick in. // Make sure your source files are compiled, as they will not be processed in any way. - new ModuleScopePlugin(paths.appSrc), + new ModuleScopePlugin(paths.appSrc, [paths.appPackageJson]), ], }, module: { diff --git a/packages/react-scripts/config/webpack.config.prod.js b/packages/react-scripts/config/webpack.config.prod.js index 1ba1307bb3e..0042f054ae1 100644 --- a/packages/react-scripts/config/webpack.config.prod.js +++ b/packages/react-scripts/config/webpack.config.prod.js @@ -117,7 +117,7 @@ module.exports = { // To fix this, we prevent you from importing files out of src/ -- if you'd like to, // please link the files into your node_modules/ and let module-resolution kick in. // Make sure your source files are compiled, as they will not be processed in any way. - new ModuleScopePlugin(paths.appSrc), + new ModuleScopePlugin(paths.appSrc, [paths.appPackageJson]), ], }, module: { diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index d7d52a7f38a..9dc2e237928 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,6 +1,7 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; +import { version, name } from '../../package.json'; class App extends Component { render() { @@ -9,6 +10,7 @@ class App extends Component {

logo

Welcome to React

+

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From 077366edf4e215137f194fe62e6a2ad9fbb9ee2d Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 29 Jun 2017 16:30:48 +0300 Subject: [PATCH 09/14] Remove package.json import from App.js template --- packages/react-scripts/template/src/App.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index 9dc2e237928..d7d52a7f38a 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,7 +1,6 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; -import { version, name } from '../../package.json'; class App extends Component { render() { @@ -10,7 +9,6 @@ class App extends Component {

logo

Welcome to React

-

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From f42dba065b3e61b08d32a3b784c5a8b68cdce8a7 Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 29 Jun 2017 16:52:39 +0300 Subject: [PATCH 10/14] Add package.json to react-scripts/template, show package version and name in the template --- packages/react-scripts/config/paths.js | 6 +++--- packages/react-scripts/template/package.json | 5 +++++ packages/react-scripts/template/src/App.js | 2 ++ 3 files changed, 10 insertions(+), 3 deletions(-) create mode 100644 packages/react-scripts/template/package.json diff --git a/packages/react-scripts/config/paths.js b/packages/react-scripts/config/paths.js index 94e399f0f4e..abdd7262fac 100644 --- a/packages/react-scripts/config/paths.js +++ b/packages/react-scripts/config/paths.js @@ -105,13 +105,13 @@ if ( appPublic: resolveOwn('template/public'), appHtml: resolveOwn('template/public/index.html'), appIndexJs: resolveOwn('template/src/index.js'), - appPackageJson: resolveOwn('package.json'), + appPackageJson: resolveOwn('template/package.json'), appSrc: resolveOwn('template/src'), yarnLockFile: resolveOwn('template/yarn.lock'), testsSetup: resolveOwn('template/src/setupTests.js'), appNodeModules: resolveOwn('node_modules'), - publicUrl: getPublicUrl(resolveOwn('package.json')), - servedPath: getServedPath(resolveOwn('package.json')), + publicUrl: getPublicUrl(resolveOwn('template/package.json')), + servedPath: getServedPath(resolveOwn('template/package.json')), // These properties only exist before ejecting: ownPath: resolveOwn('.'), ownNodeModules: resolveOwn('node_modules'), diff --git a/packages/react-scripts/template/package.json b/packages/react-scripts/template/package.json new file mode 100644 index 00000000000..973ccff60f9 --- /dev/null +++ b/packages/react-scripts/template/package.json @@ -0,0 +1,5 @@ +{ + "name": "my-app", + "version": "0.1.0", + "private": true +} diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index d7d52a7f38a..6cd18d6c58e 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,6 +1,7 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; +import { version, name } from '../package.json'; class App extends Component { render() { @@ -9,6 +10,7 @@ class App extends Component {

logo

Welcome to React

+

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From c223f86f6878dc77a89ea64bb41811eac842e964 Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 29 Jun 2017 19:17:34 +0300 Subject: [PATCH 11/14] Remove import package.json from template --- packages/react-scripts/template/src/App.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/packages/react-scripts/template/src/App.js b/packages/react-scripts/template/src/App.js index 6cd18d6c58e..d7d52a7f38a 100644 --- a/packages/react-scripts/template/src/App.js +++ b/packages/react-scripts/template/src/App.js @@ -1,7 +1,6 @@ import React, { Component } from 'react'; import logo from './logo.svg'; import './App.css'; -import { version, name } from '../package.json'; class App extends Component { render() { @@ -10,7 +9,6 @@ class App extends Component {

logo

Welcome to React

-

{`${name} v${version}`}

To get started, edit src/App.js and save to reload. From 7ac9883a18a322c8ca7462ce4e539dfc35b9b68d Mon Sep 17 00:00:00 2001 From: Doron Pagot Date: Thu, 29 Jun 2017 20:38:34 +0300 Subject: [PATCH 12/14] Remove template/package.json and its references in code --- packages/react-dev-utils/ModuleScopePlugin.js | 2 +- packages/react-scripts/config/paths.js | 6 +++--- packages/react-scripts/template/package.json | 5 ----- 3 files changed, 4 insertions(+), 9 deletions(-) delete mode 100644 packages/react-scripts/template/package.json diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index a582c9bcdbf..1ffba03cbf7 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -13,7 +13,7 @@ const chalk = require('chalk'); const path = require('path'); class ModuleScopePlugin { - constructor(appSrc, allowedPaths) { + constructor(appSrc, allowedPaths = []) { this.appSrc = appSrc; this.allowedPaths = new Set(allowedPaths); } diff --git a/packages/react-scripts/config/paths.js b/packages/react-scripts/config/paths.js index abdd7262fac..94e399f0f4e 100644 --- a/packages/react-scripts/config/paths.js +++ b/packages/react-scripts/config/paths.js @@ -105,13 +105,13 @@ if ( appPublic: resolveOwn('template/public'), appHtml: resolveOwn('template/public/index.html'), appIndexJs: resolveOwn('template/src/index.js'), - appPackageJson: resolveOwn('template/package.json'), + appPackageJson: resolveOwn('package.json'), appSrc: resolveOwn('template/src'), yarnLockFile: resolveOwn('template/yarn.lock'), testsSetup: resolveOwn('template/src/setupTests.js'), appNodeModules: resolveOwn('node_modules'), - publicUrl: getPublicUrl(resolveOwn('template/package.json')), - servedPath: getServedPath(resolveOwn('template/package.json')), + publicUrl: getPublicUrl(resolveOwn('package.json')), + servedPath: getServedPath(resolveOwn('package.json')), // These properties only exist before ejecting: ownPath: resolveOwn('.'), ownNodeModules: resolveOwn('node_modules'), diff --git a/packages/react-scripts/template/package.json b/packages/react-scripts/template/package.json deleted file mode 100644 index 973ccff60f9..00000000000 --- a/packages/react-scripts/template/package.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "name": "my-app", - "version": "0.1.0", - "private": true -} From fab0f91cd16b777a9367feaf259954e3c82d0c11 Mon Sep 17 00:00:00 2001 From: Joe Haddad Date: Tue, 1 Aug 2017 21:39:00 -0400 Subject: [PATCH 13/14] Update ModuleScopePlugin.js --- packages/react-dev-utils/ModuleScopePlugin.js | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/react-dev-utils/ModuleScopePlugin.js b/packages/react-dev-utils/ModuleScopePlugin.js index 1ffba03cbf7..3a10904d36b 100644 --- a/packages/react-dev-utils/ModuleScopePlugin.js +++ b/packages/react-dev-utils/ModuleScopePlugin.js @@ -13,9 +13,9 @@ const chalk = require('chalk'); const path = require('path'); class ModuleScopePlugin { - constructor(appSrc, allowedPaths = []) { + constructor(appSrc, allowedFiles = []) { this.appSrc = appSrc; - this.allowedPaths = new Set(allowedPaths); + this.allowedFiles = new Set(allowedFiles); } apply(resolver) { @@ -45,7 +45,7 @@ class ModuleScopePlugin { path.dirname(request.context.issuer), request.__innerRequest_request ); - if (this.allowedPaths.has(requestFullPath)) { + if (this.allowedFiles.has(requestFullPath)) { return callback(); } // Find path from src to the requested file From daf59f47c96f5ce3a0aa9afed39806d08f60a2a6 Mon Sep 17 00:00:00 2001 From: Joe Haddad Date: Tue, 1 Aug 2017 21:39:34 -0400 Subject: [PATCH 14/14] Update README.md --- packages/react-dev-utils/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/react-dev-utils/README.md b/packages/react-dev-utils/README.md index e31ae492c86..2857b1fb5cf 100644 --- a/packages/react-dev-utils/README.md +++ b/packages/react-dev-utils/README.md @@ -57,7 +57,7 @@ module.exports = { ``` -#### `new ModuleScopePlugin(appSrc: string, allowedPaths: [string])` +#### `new ModuleScopePlugin(appSrc: string, allowedFiles?: string[])` This Webpack plugin ensures that relative imports from app's source directory don't reach outside of it.