fix(add): refuse to write a template outside the project

Author: danielroe

packages/nuxt-cli/src/commands/add-template.ts

@@ -6,7 +6,7 @@ import { styleText } from 'node:util'
 
 import{intro,outro}from'@clack/prompts'
 import{defineCommand}from'citty'
-import{dirname,resolve}from'pathe'
+import{dirname,isAbsolute,relative,resolve}from'pathe'
 
 import{loadKit}from'../utils/kit'
 import{logger}from'../utils/logger'
@@ -99,6 +99,13 @@ export default defineCommand({
 constkit=awaitloadKit(cwd)
 constconfig=awaitkit.loadNuxtConfig({ cwd })
 constres=templates[templateName]({ name,args: ctx.args,nuxtOptions: config})
+
+if(escapesRoot(cwd,res.path)){
+logger.error(`Refusing to write outside ${styleText('cyan',cwd)}: ${styleText('cyan',res.path)}.`)
+logger.info('Pass a name relative to the project, without leading slashes or `..` segments.')
+process.exit(1)
+}
+
 constparentDir=dirname(res.path)
 constcreatedDir=awaitfsp.mkdir(parentDir,{recursive: true})
 if(createdDir){
@@ -123,3 +130,8 @@ export default defineCommand({
 outro(`Generated a new ${styleText('cyan',templateName)}!`)
 },
 })
+
+exportfunctionescapesRoot(root: string,path: string): boolean{
+constrel=relative(resolve(root),resolve(path))
+return!rel||rel.startsWith('../')||rel==='..'||isAbsolute(rel)
+}

packages/nuxt-cli/test/unit/templates.spec.ts

@@ -1,6 +1,8 @@
 importtype{NuxtOptions}from'@nuxt/schema'
+import{resolve}from'pathe'
 import{describe,expect,it}from'vitest'
 
+import{escapesRoot}from'../../src/commands/add-template'
 import{templates}from'../../src/utils/templates/index'
 
 describe('templates',()=>{
@@ -10,3 +12,21 @@ describe('templates', () => {
 }
 })
 })
+
+describe('escapesRoot',()=>{
+it('should reject a name that traverses out of the project',()=>{
+expect(escapesRoot('/project',resolve('/project/components','../../etc/passwd.vue'))).toBe(true)
+})
+
+it('should reject an absolute name',()=>{
+expect(escapesRoot('/project',resolve('/project/components','/etc/passwd.vue'))).toBe(true)
+})
+
+it('should reject the project root itself',()=>{
+expect(escapesRoot('/project','/project')).toBe(true)
+})
+
+it('should allow a nested name',()=>{
+expect(escapesRoot('/project',resolve('/project/components','nested/Thing.vue'))).toBe(false)
+})
+})