fix: do not follow absolute paths outside job base (#568)

related to
sveltejs/kit#13764 (comment)

SvelteKit stringifies environment variables during build so that it can
inject static values into the build output instead of always reading the
env vars dynamically. However, `@vercel/nft` interprets any absolute
path as an asset it should add. This causes builds on Vercel's build
system to balloon in function size because it traces and bundles paths
such as Node, Yarn global, etc. Often, this causes the deployment to
fail because the function size exceeds the limit.

This PR ensures asset paths outside the given job base are ignored to
help us avoid packaging in system dependencies.

~Draft for now because I'm not confident that this fix doesn't break
lots of other things~

Author: teemingc

src/analyze.ts

@@ -1169,9 +1169,33 @@ export default async function analyze(
       return;
     }
     if (wildcardIndex !== -1 && stats.isFile()) return;
+    // do not emit assets outside the package boundary if inside node_modules
+    if (pkgBase) {
+      const nodeModulesBase =
+        id.substring(0, id.indexOf(path.sep + 'node_modules')) +
+        path.sep +
+        'node_modules' +
+        path.sep;
+      if (!assetPath.startsWith(nodeModulesBase)) {
+        if (job.log)
+          console.log(
+            'Skipping asset emission of ' +
+              assetPath +
+              ' for ' +
+              id +
+              ' as it is outside the package base ' +
+              pkgBase,
+          );
+        return;
+      }
+    }
     if (stats.isFile()) {
+      // do not emit file assets outside job.base
+      if (job.ignoreFn(path.relative(job.base, assetPath))) return;
       assets.add(assetPath);
     } else if (stats.isDirectory()) {
+      // do not emit directory assets outside job.base
+      if (job.ignoreFn(path.relative(job.base, assetPath))) return;
       if (validWildcard(assetPath)) emitAssetDirectory(assetPath);
     }
   }

test/unit/pkg-dir-outside-base/.gitignore

@@ -0,0 +1 @@
+!node_modules 

test/unit/pkg-dir-outside-base/input.js

@@ -0,0 +1 @@
+require('some-pkg');

test/unit/pkg-dir-outside-base/node_modules/some-pkg/index.js

@@ -0,0 +1,6 @@
+[
+  "package.json",
+  "test/unit/pkg-dir-outside-base/input.js",
+  "test/unit/pkg-dir-outside-base/node_modules/some-pkg/index.js",
+  "test/unit/pkg-dir-outside-base/node_modules/some-pkg/package.json"
+]

test/unit/pkg-dir-outside-base/node_modules/some-pkg/package.json

@@ -0,0 +1 @@
+secret

test/unit/pkg-dir-outside-base/output.js

@@ -0,0 +1 @@
+!node_modules 

test/unit/pkg-dir-outside-base/secret-dir/secret.txt

@@ -0,0 +1 @@
+require('some-pkg');