This problem bloats the ELM_HOME unnecessarily and increases download times.
Thankfully, as of now, I can't figure a way that this can lead to people executing arbitrary JavaScript code.
Possible solution exploration
I don't know how the packaging works exactly, but I imagine that the solution includes changing the predicate in writeEntry so that it recurses over directories and includes only .elm files (and *.js files for elm/elm-explorations).
Quick Summary: When publishing a package, the compiler will bundle all the files in
src/
, even if they're not relevant to the compilation.SSCCE
As explained in https://github.com/ryannhg/elm-spa/issues/132,
ryanhhg/elm-spa
as of 6.0.4 suffers from this problem.Additional Details
This problem bloats the ELM_HOME unnecessarily and increases download times.
Thankfully, as of now, I can't figure a way that this can lead to people executing arbitrary JavaScript code.
Possible solution exploration
I don't know how the packaging works exactly, but I imagine that the solution includes changing the predicate in
writeEntry
so that it recurses over directories and includes only.elm
files (and*.js
files forelm
/elm-explorations
).