fix: sanitise package.json files field (#800)

* fix: sanitise package.json files field * Apply suggestions from code review Co-authored-by: Eduardo Bouças <mail@eduardoboucas.com> Co-authored-by: Netlify Team Account 1 <netlify-team-account-1@users.noreply.github.com> Co-authored-by: Eduardo Bouças <mail@eduardoboucas.com>
netlify · Nov 9, 2021 · 6c82ada · 6c82ada · github-actions · Nov 9, 2021
1 parent 87de250
commit 6c82ada
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 3 deletions.
diff --git a/src/runtimes/node/utils/package_json.ts b/src/runtimes/node/utils/package_json.ts
@@ -14,6 +14,19 @@ interface PackageJson {
   type?: string
 }
 
+const sanitiseFiles = (files: unknown): string[] | undefined => {
+  if (!Array.isArray(files)) {
+    return undefined
+  }
+
+  return files.filter((file) => typeof file === 'string')
+}
+
+const sanitisePackageJson = (packageJson: Record<string, unknown>): PackageJson => ({
+  ...packageJson,
+  files: sanitiseFiles(packageJson.files),
+})
+
 // Retrieve the `package.json` of a specific project or module
 const getPackageJson = async function (srcDir: string): Promise<PackageJson> {
   const packageRoot = await pkgDir(srcDir)
@@ -25,11 +38,12 @@ const getPackageJson = async function (srcDir: string): Promise<PackageJson> {
   const packageJsonPath = `${packageRoot}/package.json`
   try {
     // The path depends on the user's build, i.e. must be dynamic
-    // eslint-disable-next-line import/no-dynamic-require, node/global-require
-    return require(packageJsonPath)
+    // eslint-disable-next-line import/no-dynamic-require, node/global-require, @typescript-eslint/no-var-requires
+    const packageJson = require(packageJsonPath)
+    return sanitisePackageJson(packageJson)
   } catch (error) {
     throw new Error(`${packageJsonPath} is invalid JSON: ${error.message}`)
   }
 }
 
-export { getPackageJson, PackageJson }
+export { getPackageJson, PackageJson, sanitisePackageJson }
diff --git a/tests/unit.js b/tests/unit.js
@@ -0,0 +1,23 @@
+const test = require('ava')
+
+const { sanitisePackageJson } = require('../dist/runtimes/node/utils/package_json')
+
+test('sanitisePackageJson', (t) => {
+  t.deepEqual(
+    sanitisePackageJson({
+      files: ['a.js', null, 'b.js'],
+    }),
+    {
+      files: ['a.js', 'b.js'],
+    },
+  )
+
+  t.deepEqual(
+    sanitisePackageJson({
+      files: { 'a.js': true, 'b.js': false },
+    }),
+    {
+      files: undefined,
+    },
+  )
+})