Angular CLI can copy files from outside the workspace root through symlinked asset directories

[SkyZeroZx]

Command

build

Is this a regression?

• Yes, this behavior used to work in the previous version

The previous version in which this bug was not present was

No response

Description

ng build can copy files from outside the workspace into the build output when an asset directory is a symbolic link.

The application builder checks that every asset path stays inside the workspace root before globbing it:

if (!isSubDirectory(root, entry.input)) {
  throw new Error(`The ${entry.input} asset path must be within the workspace root.`);
}

const cwd = path.resolve(root, entry.input);

const files = await glob(entry.glob, {
  cwd,
  dot: true,
  ignore: entry.ignore ? defaultIgnore.concat(entry.ignore) : defaultIgnore,
  followSymbolicLinks: entry.followSymlinks,
});

That check is lexical. isSubDirectory() resolves both operands with resolve(), compares them with relative(), and never calls realpath:

function isSubDirectory(parent, child) {
  const resolvedParent = resolve(parent);
  const resolvedChild = resolve(parent, child);
  const relativePath = toPosixPath(relative(resolvedParent, resolvedChild));
  return relativePath !== '..' && !relativePath.startsWith('../') && !isAbsolute(relativePath);
}

A symlink inside the project resolves inside the workspace root, passes the check, and is then used as the globber's cwd, which reads through it to the real target.

Whether the globber walks through it depends on followSymlinks, and the value that arrives there is not the documented one. schema.json declares:

"followSymlinks": {
  "type": "boolean",
  "default": false,
  "description": "Allow glob patterns to follow symlink directories. This allows subdirectories of the symlink to be searched."
}

The schema registry builds Ajv without useDefaults:

this._ajv = new ajv.default({
  strict: false,
  loadSchema: (uri) => this._fetch(uri),
  passContext: true,
  verbose: true,
});

so schema defaults are never written into the options object. When the option is not set, entry.followSymlinks is undefined, and tinyglobby treats undefined the same as true:

followSymbolicLinks: undefined  ->  [ 'link/secret.txt' ]
followSymbolicLinks: false      ->  [ ]
followSymbolicLinks: true       ->  [ 'link/secret.txt' ]

The documented default is false. The effective default is true.

The containment check does hold for the direct form, which is what shows it is meant to hold:

assets: [{ "glob": "**/*", "input": "../../../outside" }]

An unhandled exception occurred: The ../../../outside asset path must be within the workspace root.

The same target reached through a symlink is copied with no warning and a successful build.

The configuration ng new generates already globs the whole public/ directory, so angular.json does not need to change:

"assets": [{ "glob": "**/*", "input": "public" }]

A symbolic link is a git object of mode 120000 whose content is a path string, so it survives clone. Nothing is executed during the build, so npm ci --ignore-scripts does not change the outcome.

Minimal Reproduction

See https://github.com/SkyZeroZx/angular-cli-symlink-asset-escape-poc

The same thing reproduces on a stock application in six commands:

npx @angular/cli@22.2.0 new repro-app --defaults --skip-git
cd repro-app

mkdir -p /tmp/outside-the-workspace
echo "this file is outside the Angular workspace" > /tmp/outside-the-workspace/secret.txt

ln -s /tmp/outside-the-workspace public/docs

ng build
find dist -name 'secret.txt'

The build completes normally and the file from outside the workspace is in the output:

dist/repro-app/browser/docs/secret.txt

Setting the option to the value the schema already documents as its default stops it:

assets: [{ "glob": "**/*", "input": "public", "followSymlinks": false }]

Exception or Error

Your Environment

Angular CLI 22.2.0
@angular/build 22.2.0
Node.js 24.21.0
npm 10.9.7
Linux x64
tinyglobby 0.2.17

Anything else relevant?

The symlink target can be an absolute path or a relative one such as ../../../.., so it does not need to know the layout of the machine that runs the build.

[alan-agius4]

Thanks for reporting this and providing a reproduction.

However, this is working as intended and is not considered a bug:

1. Threat model & trust boundaries: Running ng build operates within a trusted development and build environment. Creating or committing symbolic links to the repository requires write access to the source code. Anyone with access to add files or symlinks to the source tree already has full control over the code and can directly execute arbitrary logic or modify the application. Build tooling is not a sandbox designed to defend against malicious repository content.
2. Purpose of the containment check: The lexical check (isSubDirectory(root, entry.input)) is a developer guardrail intended to catch accidental configuration errors and typos in angular.json (such as relative parent escapes ../../.. in input), rather than an isolation boundary against filesystem symlinks.
3. Expected filesystem behavior: Symbolic links are a standard OS filesystem mechanism intentionally used in monorepos and development setups to share static assets without duplicating files. Resolving them when traversing asset directories is standard behavior.