[CB-7183] Prevent plugins from modifying files outside of the project

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Component/s: cordova-lib
• Labels: cordova-6.0.0
• Assignee: Byoungro So
• Reporter: Andrew Grieve
• Created: 21/Jul/14 19:39
• Updated: 23/Aug/18 06:52
• Resolved: 21/Dec/15 22:48

Description

Right now this is possible:

<source-file src="src/someScript.js" target-dir="../../../../../hooks/pre_package"/>

We should ensure that plugins are not able to touch files outside of the project directory!