Unexpected Behavior in Prettier 3.0.3: Attempts to Format Files Outside of Project Directory

[SGJ-Skarp]

Prettier 3.0.3

# Options:
--single-quote --trailing-comma es5 --semi --end-of-line lf --tab-width 2

Note: The bug was confirmed to occur even with no Prettier options specified.

Input:

prettier --write '{,src}/**/*.{ts,tsx,js,json}'

Output:

[error] Unable to expand glob pattern: "{,src}/**/*.{ts,tsx,js,json}".
[error] EACCES: permission denied, scandir '/lost+found'

Expected behavior:

When using a glob pattern that specifies both the root directory (using an empty string) and a subdirectory (e.g. src), Prettier should only attempt to format files within the specified project or directory. It should not attempt to access or format files outside the project's directory, especially system directories like /lost+found.

Additional Information:

• The issue was observed after upgrading from Prettier version 3.0.2 to 3.0.3.
• Changing the pattern to src/**/*.{ts,tsx,js,json} fixed the problem on my end.

[fisker]

Possible cased by #15001, but seems the new behavior is expected?

The original pattern is like /**/* + src/**/*.

[SGJ-Skarp]

Possibly, I'd call it a breaking change then. But I don't think traversing the entirety of my file system should ever really be the expected behavior. That said, I'm not sure how I'd effectively limit the scope, but I just think it's dangerous that prettier could technically change files some place completely different (even if prettier attempts to not make destructive changes). I might not even have the option to roll back the changes if it happens outside my git repository.

[fisker]

Your concern make sense.

Maybe we can throw errors when CLI try to format files above CWD?

[SGJ-Skarp]

Yeah. I don't really see when you'd expect prettier to run outside your CWD? I suspect most people probably run it through some npm script, in which case the location of the package.json would be the CWD. And if I wanted to run prettier locally on some specific files, I would probably expect it to stay very localised.

So I think your suggestion sounds reasonable enough.

[kachkaev]

Yeah. I don't really see when you'd expect prettier to run outside your CWD?

It makes sense when Prettier is installed globally or ran via npx. We can throw when formatting files in / though.