Repository navigation
AssetManager copies entire bower-asset package (including executable test/script files) to web/assets #20838
Description
Activity
You can configure the asset to your liking; in the settings, you only need to add:
public $publishOptions = [ 'only' => [ 'jquery.pjax.js', ], ];
The whole package gets published because
PjaxAsset::$sourcePathpoints at the package root (@bower/yii2-pjax) with no$publishOptionsset (framework/widgets/PjaxAsset.php:21), soAssetManagercopies the entire directory throughFileHelper::copyDirectory(). Onlyjquery.pjax.jsis actually used;script/,test/,vendor/,Gemfile, the*.mdfiles and so on come along with it.On the
script/bootstrap|server|testworry: those are shell scripts, and the web server serves them as static text rather than executing them, so this is information disclosure and docroot clutter, not RCE. Still no reason for them to be published.@terabytesoftw's
publishOptions = ['only' => ['jquery.pjax.js']]fixes it per app. The open question is whether to bake that into the bundle so every app is clean by default:// PjaxAsset public $publishOptions = ['only' => ['jquery.pjax.js']];
PunycodeAssethas the same shape ($sourcePath = '@bower/punycode', onlypunycode.jsused, root carriesscripts/,tests/,.github/), so it would want['only' => ['punycode.js']]too. The other core bundles point atdistor@yii/assets, so they're unaffected.It's a small change to the default published file set (only build/test/doc files stop being copied, the asset itself is untouched), but it does change a public bundle's default, so probably a CHANGELOG entry plus an UPGRADE note.
Do you want this promoted to the bundle defaults (PjaxAsset and PunycodeAsset), or kept as per-app config / documented? Happy to send a PR once you decide.
Description
AssetManager copies entire bower-asset package (including executable test/script files) to web/assets
and after including the pjax component in a view - when a client accesses the site, the following files and subfolders appear in web/assets/<random_name>/ directory from vendor/bower-assets/:
The contents of all these files and subfolders can be viewed (if directory listing is not disabled at the web server level).
What particularly concerns me are three "executable" files in the "/script" folder:
I'm not sure if this poses a security threat to the site, but it seems to me that their presence in web/assets is clearly unnecessary.
Package version
2.0.54
PHP version
8.3.30