From 70390db6ebd253107984bc5951714fb32c0b5924 Mon Sep 17 00:00:00 2001
From: Chris Blossom <cbloss@gmail.com>
Date: Thu, 11 Jul 2019 16:28:14 -0700
Subject: [PATCH] Fix safeCheck to take into account cwd option

---
 index.js     | 24 +++++++++++++-----------
 package.json |  2 +-
 test.js      | 30 ++++++++++++++++++++++++++++++
 3 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/index.js b/index.js
index 1d15158..021c5e3 100644
--- a/index.js
+++ b/index.js
@@ -3,39 +3,40 @@ const {promisify} = require('util');
 const path = require('path');
 const globby = require('globby');
 const isPathCwd = require('is-path-cwd');
-const isPathInCwd = require('is-path-in-cwd');
+const isPathInside = require('is-path-inside');
 const rimraf = require('rimraf');
 const pMap = require('p-map');
 
 const rimrafP = promisify(rimraf);
 
-function safeCheck(file) {
+function safeCheck(file, cwd) {
 	if (isPathCwd(file)) {
 		throw new Error('Cannot delete the current working directory. Can be overridden with the `force` option.');
 	}
 
-	if (!isPathInCwd(file)) {
+	if (!isPathInside(file, cwd)) {
 		throw new Error('Cannot delete files/directories outside the current working directory. Can be overridden with the `force` option.');
 	}
 }
 
-module.exports = async (patterns, {force, dryRun, ...options} = {}) => {
+module.exports = async (patterns, {force, dryRun, cwd = process.cwd(), ...options} = {}) => {
 	options = {
 		expandDirectories: false,
 		onlyFiles: false,
 		followSymbolicLinks: false,
+		cwd,
 		...options
 	};
 
 	const files = await globby(patterns, options);
 
 	const mapper = async file => {
+		file = path.resolve(cwd, file);
+
 		if (!force) {
-			safeCheck(file);
+			safeCheck(file, cwd);
 		}
 
-		file = path.resolve(options.cwd || '', file);
-
 		if (!dryRun) {
 			await rimrafP(file, {glob: false});
 		}
@@ -46,21 +47,22 @@ module.exports = async (patterns, {force, dryRun, ...options} = {}) => {
 	return pMap(files, mapper, options);
 };
 
-module.exports.sync = (patterns, {force, dryRun, ...options} = {}) => {
+module.exports.sync = (patterns, {force, dryRun, cwd = process.cwd(), ...options} = {}) => {
 	options = {
 		expandDirectories: false,
 		onlyFiles: false,
 		followSymbolicLinks: false,
+		cwd,
 		...options
 	};
 
 	return globby.sync(patterns, options).map(file => {
+		file = path.resolve(cwd, file);
+
 		if (!force) {
-			safeCheck(file);
+			safeCheck(file, cwd);
 		}
 
-		file = path.resolve(options.cwd || '', file);
-
 		if (!dryRun) {
 			rimraf.sync(file, {glob: false});
 		}
diff --git a/package.json b/package.json
index c4bbb12..054bfb2 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
 	"dependencies": {
 		"globby": "^10.0.0",
 		"is-path-cwd": "^2.0.0",
-		"is-path-in-cwd": "^2.0.0",
+		"is-path-inside": "^3.0.1",
 		"p-map": "^2.0.0",
 		"rimraf": "^2.6.3"
 	},
diff --git a/test.js b/test.js
index 6106480..928cf0a 100644
--- a/test.js
+++ b/test.js
@@ -106,3 +106,33 @@ test('don\'t delete files, but return them - sync', t => {
 		path.join(t.context.tmp, '4.tmp')
 	]);
 });
+
+test('delete relative files outside of process.cwd using cwd - async', async t => {
+	await del(['1.tmp'], {cwd: t.context.tmp});
+
+	exists(t, ['2.tmp', '3.tmp', '4.tmp', '.dot.tmp']);
+	notExists(t, ['1.tmp']);
+});
+
+test('delete relative files outside of process.cwd using cwd - sync', t => {
+	del.sync(['1.tmp'], {cwd: t.context.tmp});
+
+	exists(t, ['2.tmp', '3.tmp', '4.tmp', '.dot.tmp']);
+	notExists(t, ['1.tmp']);
+});
+
+test('delete absolute files outside of process.cwd using cwd - async', async t => {
+	const absolutePath = path.resolve(t.context.tmp, '1.tmp');
+	await del([absolutePath], {cwd: t.context.tmp});
+
+	exists(t, ['2.tmp', '3.tmp', '4.tmp', '.dot.tmp']);
+	notExists(t, ['1.tmp']);
+});
+
+test('delete absolute files outside of process.cwd using cwd - sync', t => {
+	const absolutePath = path.resolve(t.context.tmp, '1.tmp');
+	del.sync([absolutePath], {cwd: t.context.tmp});
+
+	exists(t, ['2.tmp', '3.tmp', '4.tmp', '.dot.tmp']);
+	notExists(t, ['1.tmp']);
+});