feat: allowOutsideReadDir configuration

[eromano]

Load file from an external folder now fails because of this check :
An asset cannot be read from a location outside the project
Introduced by the PR:
64c6031#diff-9eb0a75e499bdadd44d6dc62218812b8
With allowOutsideOutDir property asset configuration the user can decide to allow this kind of behaviour:

"assets": [
  {
    "glob": "**/*",
    "input": "/temp-folder/outside-allowed/of/project",
    "output": "../not-dist/some/folder/",
    "allowOutsideReadDir": true
  },
]

it is false by default and be enabled by the user only when he knows the security risk behind this kind of decision.

See issue: #8783

[eromano]

Hi guys this PR is needed to our project https://github.com/Alfresco/alfresco-ng2-components in order to update the angular cli.
If you want I am happy to illustrate the problem that we need to solve

[tleveque23]

Any news on this one? Seems that only some reviews are missing. This bug is really annoying for our project....

[bjornharvold]

Interested in how this will get resolved as well. Wouldn't having a mono repo with common assets in an external directory be a good use case for this feature? In my case, I have Ethereum contracts in one project that needs to be compiled and then used by an admin app and a consumer app. All 3 projects are in the same mono repo at the same level.

[hansl]

@eromano Could you add a warning on compilation when the configuration option is present (and error out if it's not)?

The reason this check is there is so that people cannot ng build && deploy and end up with files they don't want (or aren't aware of) from, e.g., their home directory. There's a way to copy all your SSH keys for example to the assets directory, and someone who doesn't know better will end up with their CD keys available publicly.

This will be all removed in the soon future (next major), but we can make that fix in 1.7.0.

[prashu2705]

Hi,

When will this be merged? I'm in need of this change as well.

Thanks.

[eromano]

@hansl I have added the warning. I don't know if this PR still make sense or not.
Sorry for the late response but I didn't notice the mention

[SpellChucker]

+1 on this one too, we use a shared folder for assets outside of the project and pull them in through .angular-cli.json.

[eromano]

@hansl should I rebase it another time? or there are no intention to merge it?

[Dumpen]

This would be a greatly appreciated feature. We have a lot of shared assets that will benefit from this.

[kafumanto]

We are using sibling shared modules and this missing feature is a problem.

Is there any known workaround in the mean time?

[agustintarifa]

Any news about this?

[alexeagle]

Sorry this got stale @eromano
Sounds like this change is still needed? Will discuss with @hansl

[ngbot]

Hi @eromano! This PR has merge conflicts due to recent upstream merges.
Please help to unblock it by resolving these conflicts. Thanks!

[alexeagle]

We are okay with accepting a PR to read assets from outside the project. But this needs some work to re-base first (likely just make the change again fresh).

[alan-agius4]

Thanks for your PR. Though I'll be closing as per @alexeagle comment. Please re-open the PR when the issues are fixed and is in a mergeable state.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}