Summary
@quasar/app-vite recursively removes build.distDir before producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.
Details
The build command and mode builders passed the resolved output directory directly to fs-extra recursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.
quasar.config is trusted application code, and no attacker-controlled input reaches build.distDir by default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.
Impact
Running a normal Quasar build with an unsafe build.distDir can delete data accessible to the build user before compilation begins.
Remediation
Validate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit build.allowOutsideProjectDistDir opt-in for external output directories; and log the exact resolved target before removal.
Upgrade
Upgrade to @quasar/app-vite@3.3.0 or later.
Summary
@quasar/app-viterecursively removesbuild.distDirbefore producing build artifacts. The configured path was made absolute, but it was not checked before removal. A configuration mistake could therefore target the project root, user home directory, a filesystem root, or another directory outside the project.Details
The build command and mode builders passed the resolved output directory directly to
fs-extrarecursive removal. Existing symlink ancestors were not resolved before deletion either, so a path that appeared to be inside the project could operate on a directory outside it.quasar.configis trusted application code, and no attacker-controlled input reachesbuild.distDirby default. This issue is primarily destructive-build safety hardening. It can become a security boundary when build configuration is generated or influenced by less-trusted automation.Impact
Running a normal Quasar build with an unsafe
build.distDircan delete data accessible to the build user before compilation begins.Remediation
Validate the effective deletion target before every artifact cleanup. Always reject filesystem roots, the user home directory and the project root; resolve existing symlink ancestors; require an explicit
build.allowOutsideProjectDistDiropt-in for external output directories; and log the exact resolved target before removal.Upgrade
Upgrade to @quasar/app-vite@3.3.0 or later.