fix(@angular/build): prevent deleting parent directories of project root

[pradhankukiran]

PR Checklist

Please check to confirm your PR fulfills the following requirements:

• The commit message follows our guidelines: https://github.com/angular/angular-cli/blob/main/CONTRIBUTING.md#-commit-message-guidelines
• Tests for the changes have been added (for bug fixes / features)
• Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• Other... Please describe:

What is the current behavior?

The deleteOutputDir utility only checks if the output path is exactly equal to the project root. Setting the output path to a parent directory (e.g. ../ or ../../) bypasses this check, and ng build silently deletes all contents of that directory potentially wiping out source files or entire directory trees.

Closes: #6485

What is the new behavior?

Uses path.relative() to detect when the resolved output path is the project root OR any ancestor of it, and throws a descriptive error in both cases.

Does this PR introduce a breaking change?

• Yes
• No

Other information

The original issue reported a user losing 10 days of work after setting outDir: "../../" which caused ng build --prod to delete their entire project directory. This fix closes the gap that has been open since 2017.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the deleteOutputDir utility to prevent the deletion of the project root or its parent directories by using path.relative for validation. It also introduces a new test suite to verify these safety constraints and general functionality. A suggestion was made to move a dynamic import to the top of the test file for better consistency.

[alan-agius4]

Had a chat with @clydin about this and he correctly pointed out that this will break use-cases where the provided outputPath is absolute.

[pradhankukiran]

Thanks for the review! I tested absolute output paths and they seem to work correctly /tmp/build and /home/other/build are allowed, only ancestors like /home/user (parent of /home/user/project) are blocked. Could you share a specific example of the absolute path case that would break? Happy to adjust.

[alan-agius4]

@pradhankukiran, based on the logic there is no special handling of absolute paths and thus it will fail. All absolute paths should be allowed.

Example:

deleteOutputDir('/my-project/app', '/tmp')

[pradhankukiran]

I tested your exact example deleteOutputDir('/my-project/app', '/tmp') is allowed by the check. relative('/tmp', '/my-project/app') returns ../my-project/app which starts with .., so it passes. The check only blocks when the project root is inside the output path (the output path is an ancestor). Happy to add a test case for this if it helps.

[clydin]

On Windows, drive letters and UNC paths are also absolute and should be handled here as well.

[alan-agius4]

@pradhankukiran, as @clydin mentioned absolute paths needs to be explicitly handled.

[pradhankukiran]

Thanks for the feedback! I've added an isAbsolute() guard so that Windows drive letters and UNC paths are correctly allowed. Also added a test case for absolute paths outside the project. The nit is applied too

[alan-agius4]

NIT: I think this can be slightly simplified, made easier to follow and also make the errors more actionable.

const resolvedOutputPath = resolve(root, outputPath);
if (resolvedOutputPath === root) {
  throw new Error("Output path MUST not be workspace root directory.");
}

if (!isAbsolute(outputPath) && !resolvedOutputPath.startsWith(root)) {
  throw new Error(
    `Output path "${resolvedOutputPath}" must NOT be a parent of the workspace root directory via relative paths.`
  );
}

[pradhankukiran]

Thanks for the suggestion! I think there might be a couple of edge cases with this approach:

1. Absolute ancestors are not caught — deleteOutputDir('/home/user/project', '/home') skips the second check because isAbsolute('/home') is true, so the ancestor /home is silently allowed.
2. Relative sibling paths are incorrectly blocked — deleteOutputDir('/home/user/project', '../sibling/dist') resolves to /home/user/sibling/dist, which doesn't start with root, so it throws even though it's not an ancestor.

The relative() approach handles both of these because it directly answers "is root inside the output path?" regardless of how the path was specified.

[alan-agius4]

The second one should be blocked as it’s outside of the workspace IMHO, and the first one should be allowed as it’s absolute.

[pradhankukiran]

@alan-agius4 updated the approach per your suggestion, exact root match, and relative paths escaping the workspace. Absolute paths are now always allowed.
Also added root + sep instead of bare startsWith(root) to avoid false matches on paths like project-backup vs project.