warn if import contains ".." that traverses outside the package boundary

dart-lang / sdk

The Dart SDK, including the VM, JS and Wasm compilers, analysis, core libraries, and more.

https://dart.dev

BSD 3-Clause "New" or "Revised" License

10.07k stars 1.56k forks source link

warn if import contains ".." that traverses outside the package boundary #9734

Open danrubel opened 11 years ago

danrubel commented 11 years ago

Two cases, maybe more, where we should warn the user of a bad practice...

1) Traversing into or out of the "lib" directory with a package 2) Traversing out of one package into another

import '../lib/foo.dart'; import 'package:anypkg/../web/bar.dart';

lrhn commented 11 years ago

Could we make it just not work? I.e., treat a package: URI as a special kind of URI, not just as a shorthand for a file: URI. Then "package:<packageName>/<absolutePath>" would be the required format, and it would simply not be allowed to reach outside of "lib/packageName".

If we just transform it to a file URI blindly, then all kinds of hackery is possible, so the safest thing is to just not do that.

danrubel commented 11 years ago

That makes sense to me. Are there issues open for VM and dart2js to disallow this situation?