[ehl-jf]

• The pull request is targeting the main branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• All integration tests have passed locally as they cannot be automated yet.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

What

jf worker deploy and jf worker test-run now only read sourceCodePath from inside the worker directory (the directory holding manifest.json).

common.ReadSourceCode, the single function both commands go through:

• rejects absolute paths and paths escaping with .. (filepath.IsLocal) before touching the filesystem: invalid manifest: sourceCodePath '<p>' must be a relative path inside the worker directory
• reads the file through os.OpenRoot("."), so symlinks leaving the directory are rejected too (invalid manifest: cannot read sourceCodePath '<p>': ... path escapes from parent)
• keeps the plain "file not found" error for a missing file

Why

sourceCodePath was passed straight to os.ReadFile, so a manifest could point at any file readable by the user running the CLI, and that content was sent to the Platform as the worker source.

Behaviour change

These manifests now fail with a clear error, with no opt-out:

• absolute sourceCodePath, even when it points inside the project
• ../... paths
• symlinks that resolve outside the project

The scaffolded default ./worker.ts, subfolders, and in-project symlinks keep working.

Tests

• TestManifest_ReadSourceCode: nested path, in-dir symlink, absolute (inside and outside), .. traversal, escaping symlink, directory instead of a file
• TestDeployCommand / TestDryRun: the escaping-path case runs against a server stub with no upload endpoint and fails with the containment error
• Manual QA on a live JPD (plugin build): all escaping variants rejected for deploy and test-run, in-project variants still work, and a logging proxy shows no file content sent on rejection.

[github-actions]

Unit Tests Results

356 tests  +9   355 ✅ +9   1m 19s ⏱️ +8s
  3 suites ±0     1 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit c0586d0. ± Comparison against base commit 2e520ad.