Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: prevent yarn directory traversal on plugin installation #6829

Merged
merged 2 commits into from
Feb 7, 2025

Conversation

techchrism
Copy link
Contributor

fixes #4041 (and possibly others)

Yarn would previously traverse up the directory tree looking for a workspace package.json.
This PR prevents this behavior by writing a dummy package.json so yarn stops looking.

Solves errors that occur when a package.json exists in a parent directory (such as the user home directory or the root directory). Even when those errors don't occur, this may speed up execution very slightly by making fewer disk calls.

@CLAassistant
Copy link

CLAassistant commented Nov 20, 2023

CLA assistant check
All committers have signed the CLA.

@techchrism
Copy link
Contributor Author

@gatzjames any reason in particular this was closed?
I still have people reporting an inability to install my plugin because of the underlying issue this PR fixes.
For another recent example from a repo that isn't mine, see jreyesr/insomnia-plugin-batch-requests#17

@gatzjames gatzjames reopened this Feb 7, 2025
@gatzjames gatzjames force-pushed the fix/yarn-directory-traversal branch from 35b0626 to 041913e Compare February 7, 2025 11:04
packages/insomnia/src/main/install-plugin.ts Dismissed Show dismissed Hide dismissed
@gatzjames
Copy link
Contributor

Thanks for the PR!
We were doing some cleanup and this was closed because the issue it references seemed to be resolved.

@gatzjames gatzjames enabled auto-merge (squash) February 7, 2025 11:12
@gatzjames gatzjames merged commit cf42d46 into Kong:develop Feb 7, 2025
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Failed to install because "No license field"
3 participants