From e82da5b07a9470a5e54f4ebbd32d83e06bee12ec Mon Sep 17 00:00:00 2001
From: Till Schneidereit <till@tillschneidereit.net>
Date: Wed, 19 Mar 2025 20:23:08 +0100
Subject: [PATCH] Don't expose absolute paths to source files

This changes componentization to make paths relative to the current working directory. E.g. when componentizing `[project dir]/src/index.js`, instead of seeing that full path, content will now see `src/index.js`, because we preopen `[project dir]` as `/` and can thus treat all paths as relative to that.

This only works for Wizer, since Weval doesn't have a way to map directories in this way.
---
 src/componentize.js | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/src/componentize.js b/src/componentize.js
index 110fc621..63187900 100644
--- a/src/componentize.js
+++ b/src/componentize.js
@@ -7,7 +7,7 @@ import {
 } from '@bytecodealliance/jco';
 import { spawnSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
-import { resolve, join, basename, dirname } from 'node:path';
+import { resolve, join, dirname } from 'node:path';
 import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
 import { rmSync, existsSync } from 'node:fs';
 import { createHash } from 'node:crypto';
@@ -16,7 +16,7 @@ import {
   stubWasi,
 } from '../lib/spidermonkey-embedding-splicer.js';
 import { fileURLToPath } from 'node:url';
-import { stdout, platform } from 'node:process';
+import { cwd, stdout, platform } from 'node:process';
 export const { version } = JSON.parse(
   await readFile(new URL('../package.json', import.meta.url), 'utf8')
 );
@@ -206,11 +206,27 @@ export async function componentize(opts,
     console.log(env);
   }
 
-  let initializerPath = maybeWindowsPath(join(sourceDir, 'initializer.js'));
+  let initializerPath = join(sourceDir, 'initializer.js');
   sourcePath = maybeWindowsPath(sourcePath);
+  let workspacePrefix = dirname(sourcePath);
+
+  // If the source path is within the current working directory, strip the
+  // cwd as a prefix from the source path, and remap the paths seen by the
+  // component to be relative to the current working directory.
+  // This only works in wizer, not in weval, because the latter doesn't
+  // support --mapdir.
+  if (!opts.enableAot && workspacePrefix.startsWith(cwd())) {
+    workspacePrefix = cwd();
+    sourcePath = sourcePath.slice(workspacePrefix.length + 1);
+  }
   let args = `--initializer-script-path ${initializerPath} ${sourcePath}`;
   runtimeArgs = runtimeArgs ? `${runtimeArgs} ${args}` : args;
-  let preopens = [`--dir ${maybeWindowsPath(sourceDir)}`, `--dir ${maybeWindowsPath(dirname(sourcePath))}`];
+  let preopens = [`--dir ${sourceDir}`];
+  if (opts.enableAot) {
+    preopens.push(`--dir ${workspacePrefix}`);
+  } else {
+    preopens.push(`--mapdir /::${workspacePrefix}`);
+  }
 
   let wizerProcess;