fix(react-email): prevent export --outDir from deleting the project directory (#3749)

Co-authored-by: Vyacheslav Kurilyak <320287930+vkurilyak@users.noreply.github.com>
Co-authored-by: Felipe Freitag <felipe.freitag@resend.com>

Author: vkurilyak

.changeset/export-outdir-guard.md

@@ -0,0 +1,5 @@
+---
+'react-email': patch
+---
+
+Prevent `email export` from deleting the project, the home directory, the email templates or the static assets when `--outDir` points at them.

packages/react-email/src/cli/commands/export.ts

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { Worker } from 'node:worker_threads';
 import type { Options } from '@react-email/render';
@@ -41,6 +42,55 @@ type ExportTemplatesOptions = Options & {
   esbuildPlugins?: string;
 };
 
+const isInside = (parent: string, child: string) =>
+  child.startsWith(`${parent}${path.sep}`);
+
+export const getUnsafeOutDirMessage = (
+  outDir: string,
+  emailsDirectoryPath: string,
+  { cwd, homeDirectory }: { cwd: string; homeDirectory: string },
+): string | undefined => {
+  const resolvedOutDir = path.resolve(cwd, outDir);
+  const resolvedEmailsDirectory = path.resolve(cwd, emailsDirectoryPath);
+  const staticDirectory = path.join(resolvedEmailsDirectory, 'static');
+
+  if (resolvedOutDir === path.parse(resolvedOutDir).root) {
+    return "--outDir can't be the filesystem root.";
+  }
+
+  if (resolvedOutDir === homeDirectory) {
+    return "--outDir can't be your home directory.";
+  }
+
+  if (isInside(resolvedOutDir, homeDirectory)) {
+    return "--outDir can't contain your home directory.";
+  }
+
+  if (resolvedOutDir === cwd) {
+    return "--outDir can't be the project directory.";
+  }
+
+  if (isInside(resolvedOutDir, cwd)) {
+    return "--outDir can't contain the project directory.";
+  }
+
+  if (
+    resolvedOutDir === resolvedEmailsDirectory ||
+    isInside(resolvedOutDir, resolvedEmailsDirectory)
+  ) {
+    return "--outDir can't contain your email templates.";
+  }
+
+  if (
+    resolvedOutDir === staticDirectory ||
+    isInside(staticDirectory, resolvedOutDir)
+  ) {
+    return "--outDir can't be your static assets directory.";
+  }
+
+  return undefined;
+};
+
 // Batch so esbuild's Go-side dep graph isn't held for every entry at once.
 const BUILD_BATCH_SIZE = 10;
 
@@ -116,8 +166,36 @@ export const exportTemplates = async (
     process.exit(1);
   }
 
-  if (fs.existsSync(pathToWhereEmailMarkupShouldBeDumped)) {
-    fs.rmSync(pathToWhereEmailMarkupShouldBeDumped, { recursive: true });
+  const resolvedPathToWhereEmailMarkupShouldBeDumped = path.resolve(
+    process.cwd(),
+    pathToWhereEmailMarkupShouldBeDumped,
+  );
+
+  if (fs.existsSync(resolvedPathToWhereEmailMarkupShouldBeDumped)) {
+    const unsafeOutDirMessage = getUnsafeOutDirMessage(
+      resolvedPathToWhereEmailMarkupShouldBeDumped,
+      emailsDirectoryPath,
+      { cwd: process.cwd(), homeDirectory: os.homedir() },
+    );
+
+    if (unsafeOutDirMessage) {
+      const message = `${unsafeOutDirMessage} Choose a different --outDir, such as "out".`;
+
+      if (spinner) {
+        stopSpinnerAndPersist(spinner, {
+          symbol: logSymbols.error,
+          text: message,
+        });
+      } else {
+        console.error(message);
+      }
+
+      process.exit(1);
+    }
+
+    fs.rmSync(resolvedPathToWhereEmailMarkupShouldBeDumped, {
+      recursive: true,
+    });
   }
 
   const allTemplates = getEmailTemplatesFromDirectory(emailsDirectoryMetadata);

packages/react-email/src/cli/commands/testing/export-out-dir.spec.ts

@@ -0,0 +1,103 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { exportTemplates, getUnsafeOutDirMessage } from '../export.js';
+
+const homeDirectory = path.resolve('/home/user');
+const cwd = path.join(homeDirectory, 'project');
+const emailsDirectoryPath = './emails';
+
+const getMessage = (outDir: string, emailsDirectory = emailsDirectoryPath) =>
+  getUnsafeOutDirMessage(outDir, emailsDirectory, { cwd, homeDirectory });
+
+test('blocks the filesystem root', () => {
+  expect(getMessage(path.parse(cwd).root)).toBe(
+    "--outDir can't be the filesystem root.",
+  );
+});
+
+test('blocks the home directory', () => {
+  expect(getMessage(homeDirectory)).toBe(
+    "--outDir can't be your home directory.",
+  );
+  expect(getMessage('..')).toBe("--outDir can't be your home directory.");
+});
+
+test('blocks a parent of the home directory', () => {
+  expect(getMessage(path.dirname(homeDirectory))).toBe(
+    "--outDir can't contain your home directory.",
+  );
+});
+
+test('blocks the project directory', () => {
+  expect(getMessage('.')).toBe("--outDir can't be the project directory.");
+  expect(getMessage(cwd)).toBe("--outDir can't be the project directory.");
+});
+
+test('blocks a parent of the project directory', () => {
+  const nestedCwd = path.join(cwd, 'apps', 'emails');
+  expect(
+    getUnsafeOutDirMessage('..', emailsDirectoryPath, {
+      cwd: nestedCwd,
+      homeDirectory,
+    }),
+  ).toBe("--outDir can't contain the project directory.");
+});
+
+test('blocks the email templates directory and its parents', () => {
+  const message = "--outDir can't contain your email templates.";
+  expect(getMessage('emails')).toBe(message);
+  expect(getMessage('./emails/')).toBe(message);
+  expect(getMessage(path.join(cwd, 'emails'))).toBe(message);
+  expect(getMessage('src', './src/emails')).toBe(message);
+});
+
+test('blocks the static assets directory', () => {
+  const message = "--outDir can't be your static assets directory.";
+  expect(getMessage('emails/static')).toBe(message);
+  expect(getMessage('emails/static/images')).toBe(message);
+});
+
+test('allows other directories', () => {
+  expect(getMessage('out')).toBeUndefined();
+  expect(getMessage('out/nested')).toBeUndefined();
+  expect(getMessage('emails/out')).toBeUndefined();
+  expect(getMessage('../sibling')).toBeUndefined();
+  expect(getMessage('/tmp/react-email-out')).toBeUndefined();
+});
+
+test('refuses to remove the project directory and keeps files intact', async () => {
+  const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'export-guard-'));
+  const emailsDir = path.join(projectDir, 'emails');
+  fs.mkdirSync(emailsDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(emailsDir, 'welcome.tsx'),
+    'export default () => null;',
+  );
+  fs.writeFileSync(path.join(projectDir, 'package.json'), '{}');
+
+  const cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(projectDir);
+  const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((
+    code?: number,
+  ) => {
+    throw new Error(`process.exit(${code})`);
+  }) as never);
+  const errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+  try {
+    await expect(
+      exportTemplates('.', 'emails', { silent: true }),
+    ).rejects.toThrow('process.exit(1)');
+
+    expect(errorSpy).toHaveBeenCalledWith(
+      `--outDir can't be the project directory. Choose a different --outDir, such as "out".`,
+    );
+    expect(fs.existsSync(path.join(projectDir, 'package.json'))).toBe(true);
+    expect(fs.existsSync(path.join(emailsDir, 'welcome.tsx'))).toBe(true);
+  } finally {
+    cwdSpy.mockRestore();
+    exitSpy.mockRestore();
+    errorSpy.mockRestore();
+    fs.rmSync(projectDir, { recursive: true, force: true });
+  }
+});