feat: add BROWSERSLIST_ROOT_PATH (#819)

* feat: add BROWSERSLIST_ROOT_PATH

- check that loc is inside BROWSERSLIST_ROOT_PATH in eachParent
- add tests
- update Readme

* fix linter errors

README.md

@@ -683,6 +683,12 @@ with [environment variables]:
   BROWSERSLIST_DANGEROUS_EXTEND=1 npx webpack
    ```
 
+* `BROWSERSLIST_ROOT_PATH` to prevent reading files above this path.
+
+   ```sh
+  BROWSERSLIST_ROOT_PATH=. npx webpack
+   ```
+
 [environment variables]: https://en.wikipedia.org/wiki/Environment_variable
 
 

index.d.ts

@@ -193,6 +193,7 @@ declare global {
       BROWSERSLIST_ENV?: string
       BROWSERSLIST_IGNORE_OLD_DATA?: string
       BROWSERSLIST_STATS?: string
+      BROWSERSLIST_ROOT_PATH?: string
     }
   }
 }

node.js

@@ -50,12 +50,22 @@ function eachParent(file, callback) {
   var dir = isFile(file) ? path.dirname(file) : file
   var loc = path.resolve(dir)
   do {
+    if (!pathInRoot(loc)) break;
     var result = callback(loc)
     if (typeof result !== 'undefined') return result
   } while (loc !== (loc = path.dirname(loc)))
   return undefined
 }
 
+function pathInRoot(p) {
+  if (!process.env.BROWSERSLIST_ROOT_PATH) return true
+  var rootPath = path.resolve(process.env.BROWSERSLIST_ROOT_PATH);
+  if (path.relative(rootPath, p).substring(0,2) === '..') {
+    return false;
+  }
+  return true
+}
+
 function check(section) {
   if (Array.isArray(section)) {
     for (var i = 0; i < section.length; i++) {

test/config.test.js

@@ -120,4 +120,16 @@ test('reads config with one string', () => {
   equal(browserslist.findConfig(STRING), { defaults: 'ie 9, ie 8' })
 })
 
+test('stops at ROOT', () => {
+  browserslist.clearCaches()
+  process.env.BROWSERSLIST_ROOT_PATH = join(__dirname, 'fixtures', 'dir')
+  equal(browserslist.findConfig(FILE), undefined)
+})
+
+test('allows up to ROOT', () => {
+  browserslist.clearCaches()
+  process.env.BROWSERSLIST_ROOT_PATH = join(__dirname, 'fixtures')
+  equal(browserslist.findConfig(FILE), { defaults: ['ie 11', 'ie 10'] })
+})
+
 test.run()

test/main.test.js

@@ -21,6 +21,7 @@ test.after.each(() => {
   delete process.env.BROWSERSLIST
   delete process.env.BROWSERSLIST_CONFIG
   delete process.env.BROWSERSLIST_ENV
+  delete process.env.BROWSERSLIST_ROOT_PATH
 })
 
 test('accepts array', () => {