esbuild tries to read ".."

[nmattia]

I'm running esbuild with restricted access on macOS, where esbuild does not have access to anything outside of the current directory. Running esbuild then crashes because it tries to read the parent directory, even though it's only supposed to read app.jsx:

$ /usr/bin/sandbox-exec -f profile.sb ./node_modules/.bin/esbuild app.jsx
✘ [ERROR] Cannot read directory "..": operation not permitted

1 error

where the sandbox profile is:

(version 1)
(allow default)
(allow network*)
(deny file* (subpath "/Users/user"))
(allow file-read-metadata (subpath "/Users/user"))
(allow file* (subpath "/Users/user/project"))
(deny file* (subpath "/Applications"))
(deny file* (subpath "/Users/user/Applications"))
(allow file* (subpath "/Users/user/Library/Application Support"))

[hyrious]

This is because esbuild needs to know package.json and tsconfig.json to resolve files and adjust behaviors. For example, package.json#imports and tsconfig#path can add extra resolve rules, package.json#type can change cjs interop behavior to node or babel.

[evanw]

If you want to just read that file, you can use the transform API instead: https://esbuild.github.io/api/#transform-api. This means using cat app.jsx | esbuild on the command line.

[nmattia]

Thanks for the quick reply!

I should have clarified, I do have both a package.json and a tsconfig.json in ., so esbuild shouldn't need to go look for them in ... But maybe I'm using the command wrong, and there's a --no-discovery option or something? Also, shouldn't esbuild just abort the search if .. is not readable?

[evanw]

The reason that the parent directories are traversed ahead of time is because esbuild caches parent directory lookups for speed. You can read more about that in this thread: #938.

Thank you very much for providing an easy way to reproduce the problem. I have already fixed an issue like yours in the past here: #942. But that case raised EACCES while your case is raising EPERM instead. It should be straightforward to fix this by adding a check for EPERM (and then treating such directories as empty).

[nmattia]

Thanks for the fix!