morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1040] [Bug] Invalid package exports targets can resolve outside their package #380

New issue

Closed

opened 2026-10-15 18:24:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:28 +00:00

Owner

Originally created by @6639835 on GitHub (Oct 8, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1040

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

A package with exports: "./../outside.js" resolves to node_modules/outside.js with no limitation. The real Node resolver rejects the same package with ERR_INVALID_PACKAGE_TARGET.

Reproduction

Inventory index.js, node_modules/demo/package.json containing {"exports":"./../outside.js"}, and node_modules/outside.js in one container. Resolve demo with context: "module-specifier" and moduleKind: "import" (or require). Compare with Node's createRequire(...).resolve("demo") on the same layout.

Reproduced with the production resolver; only the import suffix changed from .js to .ts. No packaged CLI/MCP run.

Expected behavior

Validate exports targets before path normalization and refuse a target containing a forbidden parent segment. Do not record a resolved module relationship that Node cannot load.

Impact and scope

The static module graph can point at a sibling package asset. Artifact-root confinement still holds; this report concerns package resolution correctness.

REA version

5.0.0; commit 2bf3663f65.

Runtime and platform

Node.js 26.10.0; macOS arm64.

Target and artifact context

JavaScript/HTML artifact inventory.

Interface

Other

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

REA: resolution_status: resolved, resolved_path: node_modules/outside.js
Node: ERR_INVALID_PACKAGE_TARGET

Typed outcome or recovery expected

No response

Analysis or suspected cause

No response

Additional context

Resolver source

Originally created by @6639835 on GitHub (Oct 8, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1040 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior A package with `exports: "./../outside.js"` resolves to `node_modules/outside.js` with no limitation. The real Node resolver rejects the same package with `ERR_INVALID_PACKAGE_TARGET`. ### Reproduction Inventory `index.js`, `node_modules/demo/package.json` containing `{"exports":"./../outside.js"}`, and `node_modules/outside.js` in one container. Resolve `demo` with `context: "module-specifier"` and `moduleKind: "import"` (or `require`). Compare with Node's `createRequire(...).resolve("demo")` on the same layout. Reproduced with the production resolver; only the import suffix changed from .js to .ts. No packaged CLI/MCP run. ### Expected behavior Validate exports targets before path normalization and refuse a target containing a forbidden parent segment. Do not record a resolved module relationship that Node cannot load. ### Impact and scope The static module graph can point at a sibling package asset. Artifact-root confinement still holds; this report concerns package resolution correctness. ### REA version 5.0.0; commit 2bf3663f654386c9fd8c1437c49659df97bd4697. ### Runtime and platform Node.js 26.10.0; macOS arm64. ### Target and artifact context JavaScript/HTML artifact inventory. ### Interface Other ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence ```text REA: resolution_status: resolved, resolved_path: node_modules/outside.js Node: ERR_INVALID_PACKAGE_TARGET ``` ### Typed outcome or recovery expected _No response_ ### Analysis or suspected cause _No response_ ### Additional context [Resolver source](https://github.com/morluto/rea/blob/2bf3663f654386c9fd8c1437c49659df97bd4697/src/application/javascript/JavaScriptArtifactPathResolution.ts)

bsakaguchi

2026-10-15 18:24:28 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:13:04 +00:00

[PR #433] [MERGED] feat: add runtime reconstruction roadmap workflows #1982

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#380

No description provided.

Rows
Columns