✨ Replace validation - only files in project dir

Author: pavelsvagr

lib/Bootstrap.js

@@ -6,16 +6,20 @@ export class Files {
     path.join(import.meta.dirname, '..')
   )
 
-  public static async exists(path: string) {
-    const stat = await fsp.stat(path).catch(() => undefined)
+  public static async exists(filepath: string) {
+    const stat = await fsp.stat(filepath).catch(() => undefined)
     return Boolean(stat)
   }
 
-  public static async existsAndIsDir(path: string) {
-    const stat = await fsp.stat(path).catch(() => undefined)
+  public static async existsAndIsDir(filepath: string) {
+    const stat = await fsp.stat(filepath).catch(() => undefined)
     return Boolean(stat?.isDirectory())
   }
-  public static async readUtf8File(path: string) {
-    return fsp.readFile(path, 'utf8')
+  public static async readUtf8File(filepath: string) {
+    return fsp.readFile(filepath, 'utf8')
+  }
+  public static isInProjectDir(filepath: string) {
+    const file = path.normalize(filepath)
+    return file.startsWith(Files.PROJECT_DIR)
   }
 }

lib/Bootstrap.js.map

@@ -1,6 +1,7 @@
 import glob from 'fast-glob'
 import fs from 'node:fs'
 import path from 'node:path'
+import { Files } from './Files.js'
 
 export interface StarterConfig {
   module: string
@@ -105,6 +106,16 @@ export class StarterLoader {
         `Invalid config at ${path}: "replace" must be array of files where strings should be replaced`
       )
     }
+    if (config.replace) {
+      const invalidReplace = config.replace.find(
+        (replace: string) => !Files.isInProjectDir(replace)
+      )
+      if (invalidReplace) {
+        throw new Error(
+          `Invalid config at ${path}: "replace" must be array of files in the project directory, got: ${invalidReplace}`
+        )
+      }
+    }
 
     const invalidKeys = Object.keys(config).filter(
       key => !['module', 'name', 'prebuild', 'replace', 'id'].includes(key)