elm / compiler

Compiler for Elm, a functional language for reliable webapps.
https://elm-lang.org/
BSD 3-Clause "New" or "Revised" License
7.48k stars 659 forks source link

The compiler should not include non-Elm resources from the src/ folder #2249

Open jfmengels opened 2 years ago

jfmengels commented 2 years ago

Quick Summary: When publishing a package, the compiler will bundle all the files in src/, even if they're not relevant to the compilation.

SSCCE

As explained in https://github.com/ryannhg/elm-spa/issues/132, ryanhhg/elm-spa as of 6.0.4 suffers from this problem.

Additional Details

This problem bloats the ELM_HOME unnecessarily and increases download times.

Thankfully, as of now, I can't figure a way that this can lead to people executing arbitrary JavaScript code.

Possible solution exploration

I don't know how the packaging works exactly, but I imagine that the solution includes changing the predicate in writeEntry so that it recurses over directories and includes only .elm files (and *.js files for elm/elm-explorations).

github-actions[bot] commented 2 years ago

Thanks for reporting this! To set expectations:

Finally, please be patient with the core team. They are trying their best with limited resources.