-
-
Notifications
You must be signed in to change notification settings - Fork 9.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Vite: Improve handling of preview annotations #28798
Open
tobiasdiez
wants to merge
41
commits into
storybookjs:next
Choose a base branch
from
tobiasdiez:previewAnno
base: next
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+135
−122
Open
Changes from all commits
Commits
Show all changes
41 commits
Select commit
Hold shift + click to select a range
a724e02
Vite: improve handling of preview annotations
tobiasdiez 74be16e
use absolute paths in tests
tobiasdiez e625e78
update comment
tobiasdiez 71c7c57
use star imports for loading previews
tobiasdiez cdfe782
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez 869d9e1
Merge branch 'next' into previewAnno
tobiasdiez f33697e
move preview variable declaration
tobiasdiez 52c56a5
Merge branch 'previewAnno' of https://github.com/tobiasdiez/storybook…
tobiasdiez d873110
Merge branch 'next' into previewAnno
tobiasdiez 7d1b3f0
update lock file
tobiasdiez 1038c75
Merge branch 'next' into previewAnno
ndelangen eddb6cd
fixes
ndelangen d0c7fb5
fixes
ndelangen 1e98912
fix incorrect import
ndelangen a404e3a
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez aef9463
fix imports
tobiasdiez 83c947a
linting
ndelangen 9cd753e
Merge branch 'next' into previewAnno
ndelangen be2e4c8
Merge branch 'next' into previewAnno
tobiasdiez 27153b2
Merge branch 'next' into previewAnno
tobiasdiez 941324f
Merge branch 'next' into previewAnno
tobiasdiez 9391e2a
Merge branch 'next' into previewAnno
tobiasdiez 3f4900b
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez 3235249
fix tests
tobiasdiez 4ad25a5
optimze semver
tobiasdiez 300f6f4
Merge branch 'optimize-dep' into previewAnno
tobiasdiez 531b527
move slsah back to dev dep
tobiasdiez 3349a93
Merge branch 'next' into previewAnno
tobiasdiez 502248b
fix tests
tobiasdiez 5680d8d
Merge remote-tracking branch 'origin/next' into fork/tobiasdiez/previ…
kasperpeulen f5af3eb
Use inline snapshots
kasperpeulen 48f2b8d
Fix eslint
kasperpeulen d411b19
Fix timing issue
kasperpeulen d43c165
Merge remote-tracking branch 'origin/next' into fork/tobiasdiez/previ…
kasperpeulen f8fdac1
Update snapshots
kasperpeulen 90411b1
Merge branch 'next' into previewAnno
tobiasdiez cc21e5f
Fix import
tobiasdiez 00ecf1c
Merge remote-tracking branch 'upstream/next' into previewAnno
tobiasdiez 70dbdfd
Merge branch 'next' into previewAnno
tobiasdiez 7572f4c
Merge branch 'next' into previewAnno
kasperpeulen ba7be49
Merge branch 'next' into previewAnno
tobiasdiez File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 13 additions & 42 deletions
55
code/builders/builder-vite/src/utils/process-preview-annotation.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,54 +1,25 @@ | ||
import { isAbsolute, relative, resolve } from 'node:path'; | ||
|
||
import { stripAbsNodeModulesPath } from 'storybook/internal/common'; | ||
import type { PreviewAnnotation } from 'storybook/internal/types'; | ||
|
||
import slash from 'slash'; | ||
import { isAbsolute, normalize, resolve } from 'pathe'; | ||
|
||
/** | ||
* Preview annotations can take several forms, and vite needs them to be a bit more restrained. | ||
* | ||
* For node_modules, we want bare imports (so vite can process them), and for files in the user's | ||
* source, we want URLs absolute relative to project root. | ||
*/ | ||
export function processPreviewAnnotation(path: PreviewAnnotation | undefined, projectRoot: string) { | ||
// If entry is an object, take the first, which is the | ||
// bare (non-absolute) specifier. | ||
/** Preview annotations can take several forms, so we normalize them here to absolute file paths. */ | ||
export function processPreviewAnnotation(path: PreviewAnnotation, projectRoot: string) { | ||
// If entry is an object, take the absolute specifier. | ||
// This is so that webpack can use an absolute path, and | ||
// continue supporting super-addons in pnp/pnpm without | ||
// requiring them to re-export their sub-addons as we do | ||
// in addon-essentials. | ||
if (typeof path === 'object') { | ||
return path.bare; | ||
} | ||
|
||
// This should not occur, since we use `.filter(Boolean)` prior to | ||
// calling this function, but this makes typescript happy | ||
if (!path) { | ||
throw new Error('Could not determine path for previewAnnotation'); | ||
console.log( | ||
'Deprecated: Preview annotations should be strings, not objects. Use the `absolute` property instead.' | ||
); | ||
return path.absolute; | ||
} | ||
|
||
// For addon dependencies that use require.resolve(), we need to convert to a bare path | ||
// so that vite will process it as a dependency (cjs -> esm, etc). | ||
// TODO: Evaluate if searching for node_modules in a yarn pnp environment is correct | ||
if (path.includes('node_modules')) { | ||
return stripAbsNodeModulesPath(path); | ||
// If it's already an absolute path, return it. | ||
if (isAbsolute(path)) { | ||
return normalize(path); | ||
} | ||
|
||
// resolve absolute paths relative to project root | ||
const relativePath = isAbsolute(path) ? slash(relative(projectRoot, path)) : path; | ||
|
||
// resolve relative paths into absolute urls | ||
// note: this only works if vite's projectRoot === cwd. | ||
if (relativePath.startsWith('./')) { | ||
return slash(relativePath.replace(/^\.\//, '/')); | ||
} | ||
|
||
// If something is outside of root, convert to absolute. Uncommon? | ||
if (relativePath.startsWith('../')) { | ||
return slash(resolve(projectRoot, relativePath)); | ||
} | ||
|
||
// At this point, it must be relative to the root but not start with a ./ or ../ | ||
return slash(`/${relativePath}`); | ||
// resolve relative paths, relative to project root | ||
return normalize(resolve(projectRoot, path)); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't this pose a security vulnerability? Leaking the build-environment's filesystem directory-structure to the client bundle? I'm not a security expert at all, I just recall a few CVEs coming our way for exactly this, and I know we go out of our way in other places to ensure that nothing above the project root ends up in the bundle.
And maybe I'm misunderstanding this whole thing, and this doesn't actually end up in the bundle, and then it's fine. I was mostly just gauging this from the new tests.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, this only "leaks" the full path to vite - but vite will then replace it with the import of the correct output chunk upon bundling.