GHSA-q9mq-245r-4g93: Path Traversal
Summary
@quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.
Details
The build command and mode builders passed the resolved output directory directly to fs-extra recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.
quasar.config is trusted application code, and no attacker-controlled input reaches build.distDir by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.
Impact
Running a normal Quasar build with an unsafe build.distDir can delete data accessible to the build user before compilation begins.
Remediation
Validate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit build.allowOutsideProjectDistDir opt-in for external output directories; and log the exact resolved target before removal.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@quasar/app-viteto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
Require an explicit build.allowOutsideProjectDistDir opt-in before allowing an external output directory.
@quasar/app-vite build.allowOutsideProjectDistDir = explicit opt-in required - Compensating control
Before every artifact cleanup, resolve existing symlink ancestors and reject deletion targets that are a filesystem root, the user home directory, or the project root.
- Operational
Log the exact resolved deletion target immediately before removing it.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
The primary risk is to environments where build.distDir is generated or influenced by less-trusted automation. quasar.config is trusted application code, and no attacker-controlled input reaches build.distDir by default.
What must happen for data to be deleted?
A normal build must run with an unsafe effective build.distDir, and the build user must have permission to delete the targeted data. Symlink ancestors can cause a path that appears to be within the project to resolve to a directory outside it.
What can be done if patching is not immediately possible?
Validate the effective deletion target before artifact cleanup, including resolving existing symlink ancestors. Reject filesystem roots and the user home directory, and avoid allowing build configuration from less-trusted automation to select the cleanup path.