FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix(@angular/cli): serialize configuration as a single argv token in run_target strategies by herdiyana256 · Pull Request #33657 · angular/angular-cli · GitHub

fix(@angular/cli): serialize configuration as a single argv token in run_target strategies - #33657

Merged
alan-agius4 merged 2 commits into
angular:mainfrom
herdiyana256:fix-mcp-run-target-configuration-flag-injection
Aug 7, 2026
Merged

fix(@angular/cli): serialize configuration as a single argv token in run_target strategies#33657
alan-agius4 merged 2 commits into
angular:mainfrom
herdiyana256:fix-mcp-run-target-configuration-flag-injection

Conversation

Copy link
Copy Markdown
Contributor

build-target-strategy.ts, generic-target-strategy.ts, and unit-test-strategy.ts all pushed the configuration value as a separate argv element after '-c'. Since the ng CLI's argument parser does not consume a following token as the value of a string option when that token itself starts with a dash, a configuration value crafted to look like a flag (e.g. "--outputPath=...") is instead parsed as an independent, legitimately-declared option of the target's builder, silently overriding it.

Serialize configuration as a single '--configuration=value' token, matching the format serializeOptions() already uses for every other option, which is not affected by this because the value is bound to the key within one argv element.

Updated the two existing spec assertions that checked the old argv shape.

…run_target strategies

build-target-strategy.ts, generic-target-strategy.ts, and
unit-test-strategy.ts all pushed the configuration value as a separate
argv element after '-c'. Since the ng CLI's argument parser does not
consume a following token as the value of a string option when that
token itself starts with a dash, a configuration value crafted to look
like a flag (e.g. "--outputPath=...") is instead parsed as an
independent, legitimately-declared option of the target's builder,
silently overriding it.

Serialize configuration as a single '--configuration=value' token,
matching the format serializeOptions() already uses for every other
option, which is not affected by this because the value is bound to
the key within one argv element.

Updated the two existing spec assertions that checked the old argv
shape.

gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Code Review

This pull request updates the target execution strategies (build, generic, and unit test) to use the long-form --configuration=value argument instead of the short-hand -c flag when constructing command-line arguments. The corresponding unit tests have also been updated to reflect this change. I have no feedback to provide as there are no review comments.

geritzpatmar-max left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Copy link
Copy Markdown
Contributor Author

Gentle bump, same as #33653. Open two weeks with no reviewer assigned, while #33654 from the same MCP batch was reviewed and merged within a few days, so this likely slipped past the queue.

Happy to rebase if it has gone stale. @clydin could you take a look, or point it at whoever owns the MCP run_target strategies?

alan-agius4 requested a review from clydin August 7, 2026 06:46
alan-agius4 added action: review The PR is still awaiting reviews from at least one requested reviewer target: patch This PR is targeted for the next patch release labels Aug 7, 2026
clydin added action: cleanup The PR is in need of cleanup, either due to needing a rebase or in response to comments from reviews and removed action: review The PR is still awaiting reviews from at least one requested reviewer labels Aug 7, 2026

clydin commented Aug 7, 2026

Copy link
Copy Markdown
Member

Thank you for the contribution.
One file is out of format. Otherwise, LGTM.
Please correct the formatting and this can be merged.

Copy link
Copy Markdown
Contributor Author

Fixed, thanks for the review.

alan-agius4 added action: merge The PR is ready for merge by the caretaker merge: squash commits When the PR is merged, a squash and merge should be performed and removed action: cleanup The PR is in need of cleanup, either due to needing a rebase or in response to comments from reviews labels Aug 7, 2026
alan-agius4 removed the request for review from clydin August 7, 2026 14:42
alan-agius4 merged commit ecf8c08 into angular:main Aug 7, 2026
65 of 69 checks passed

Copy link
Copy Markdown
Collaborator

This PR was merged into the repository. The changes were merged into the following branches:

alan-agius4 pushed a commit that referenced this pull request Aug 7, 2026
…run_target strategies (#33657)

* fix(@angular/cli): serialize configuration as a single argv token in run_target strategies

build-target-strategy.ts, generic-target-strategy.ts, and
unit-test-strategy.ts all pushed the configuration value as a separate
argv element after '-c'. Since the ng CLI's argument parser does not
consume a following token as the value of a string option when that
token itself starts with a dash, a configuration value crafted to look
like a flag (e.g. "--outputPath=...") is instead parsed as an
independent, legitimately-declared option of the target's builder,
silently overriding it.

Serialize configuration as a single '--configuration=value' token,
matching the format serializeOptions() already uses for every other
option, which is not affected by this because the value is bound to
the key within one argv element.

Updated the two existing spec assertions that checked the old argv
shape.

* fix(@angular/cli): apply prettier formatting to unit-test-strategy_spec.ts

(cherry picked from commit ecf8c08)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: merge The PR is ready for merge by the caretaker area: @angular/cli merge: squash commits When the PR is merged, a squash and merge should be performed target: patch This PR is targeted for the next patch release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants


Back | FazBrowse Home | New Git URL