Turbopack: don't define process.cwd() in node_modules (#83452)

mischnic · web-flow · commit da54d10487a1 · 2025-09-08T23:40:08.000+02:00
Don't compile-time-define `process.cwd()` inside of node_modules.

This means that node_modules cannot break outside of their individual packages anymore, so in the worst case, a given package includes all of itself, but not anymore the whole project.

This means that a `readFileSync(path.join(process.cwd(), "something.txt")))` won't cause that file to be listed in the NFT file anymore.
diff --git a/test/production/standalone-mode/node-modules/app/layout.js b/test/production/standalone-mode/node-modules/app/layout.js
@@ -0,0 +1,8 @@
+export default function Root({ children }) {
+  return (
+    <html>
+      <head></head>
+      <body>{children}</body>
+    </html>
+  )
+}
diff --git a/test/production/standalone-mode/node-modules/app/page.js b/test/production/standalone-mode/node-modules/app/page.js
@@ -0,0 +1,10 @@
+import path from 'path'
+
+import 'foo'
+
+const projectDir = process.cwd()
+path.join(projectDir, 'app', 'static-from-app.txt')
+
+export default function Page() {
+  return 'hello'
+}
diff --git a/test/production/standalone-mode/node-modules/app/static-from-app.txt b/test/production/standalone-mode/node-modules/app/static-from-app.txt
@@ -0,0 +1 @@
+hello
diff --git a/test/production/standalone-mode/node-modules/app/static-from-pkg.txt b/test/production/standalone-mode/node-modules/app/static-from-pkg.txt
@@ -0,0 +1 @@
+hello
diff --git a/test/production/standalone-mode/node-modules/foo/index.js b/test/production/standalone-mode/node-modules/foo/index.js
@@ -0,0 +1,6 @@
+import path from 'path'
+
+const projectDir = process.cwd()
+path.join(projectDir, 'app', 'static-from-pkg.txt')
+
+export default 'foo'
diff --git a/test/production/standalone-mode/node-modules/foo/package.json b/test/production/standalone-mode/node-modules/foo/package.json
@@ -0,0 +1,4 @@
+{
+  "name": "foo",
+  "version": "0.0.0"
+}
diff --git a/test/production/standalone-mode/node-modules/next.config.js b/test/production/standalone-mode/node-modules/next.config.js
@@ -0,0 +1,6 @@
+/**
+ * @type {import('next').NextConfig}
+ */
+const nextConfig = {}
+
+module.exports = nextConfig
diff --git a/test/production/standalone-mode/node-modules/node-modules.test.ts b/test/production/standalone-mode/node-modules/node-modules.test.ts
@@ -0,0 +1,22 @@
+import { nextTestSetup } from 'e2e-utils'
+
+describe('standalone mode - NFT in node_modules', () => {
+  const dependencies = require('./package.json').dependencies
+
+  const { next, skipped } = nextTestSetup({
+    files: __dirname,
+    dependencies,
+    skipDeployment: true,
+  })
+
+  if (skipped) {
+    return
+  }
+
+  it('should not trace process.cwd calls in node_modules', async () => {
+    let trace = await next.readJSON('.next/server/app/page.js.nft.json')
+
+    expect(trace.files).toContain('../../../app/static-from-app.txt')
+    expect(trace.files).not.toContain('../../../app/static-from-pkg.txt')
+  })
+})
diff --git a/test/production/standalone-mode/node-modules/package.json b/test/production/standalone-mode/node-modules/package.json
@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "foo": "file:./foo"
+  }
+}
diff --git a/turbopack/crates/turbopack-ecmascript/src/analyzer/mod.rs b/turbopack/crates/turbopack-ecmascript/src/analyzer/mod.rs
@@ -3747,7 +3747,7 @@ pub mod test_utils {
                 }
             }
             _ => {
-                let (mut v, m1) = replace_well_known(v, compile_time_info).await?;
+                let (mut v, m1) = replace_well_known(v, compile_time_info, true).await?;
                 let m2 = replace_builtin(&mut v);
                 let m = m1 || m2 || v.make_nested_operations_unknown();
                 return Ok((v, m));
diff --git a/turbopack/crates/turbopack-ecmascript/src/analyzer/well_known.rs b/turbopack/crates/turbopack-ecmascript/src/analyzer/well_known.rs
@@ -15,6 +15,7 @@ use crate::analyzer::RequireContextValue;
 pub async fn replace_well_known(
     value: JsValue,
     compile_time_info: Vc<CompileTimeInfo>,
+    define_process_cwd: bool,
 ) -> Result<(JsValue, bool)> {
     Ok(match value {
         JsValue::Call(_, box JsValue::WellKnownFunction(kind), args) => (
@@ -23,6 +24,7 @@ pub async fn replace_well_known(
                 JsValue::unknown_empty(false, "this is not analyzed yet"),
                 args,
                 compile_time_info,
+                define_process_cwd,
             )
             .await?,
             true,
@@ -67,6 +69,7 @@ pub async fn well_known_function_call(
     _this: JsValue,
     args: Vec<JsValue>,
     compile_time_info: Vc<CompileTimeInfo>,
+    define_process_cwd: bool,
 ) -> Result<JsValue> {
     Ok(match kind {
         WellKnownFunctionKind::ObjectAssign => object_assign(args),
@@ -100,7 +103,8 @@ pub async fn well_known_function_call(
             .as_str()
             .into(),
         WellKnownFunctionKind::ProcessCwd => {
-            if let Some(cwd) = &*compile_time_info.environment().cwd().await? {
+            if define_process_cwd && let Some(cwd) = &*compile_time_info.environment().cwd().await?
+            {
                 cwd.clone().into()
             } else {
                 JsValue::unknown(
diff --git a/turbopack/crates/turbopack-ecmascript/src/references/mod.rs b/turbopack/crates/turbopack-ecmascript/src/references/mod.rs
@@ -432,6 +432,7 @@ struct AnalysisState<'a> {
     origin: ResolvedVc<Box<dyn ResolveOrigin>>,
     compile_time_info: ResolvedVc<CompileTimeInfo>,
     var_graph: &'a VarGraph,
+    define_process_cwd: bool,
     /// This is the current state of known values of function
     /// arguments.
     fun_args_values: Mutex<FxHashMap<u32, Vec<JsValue>>>,
@@ -461,6 +462,7 @@ impl AnalysisState<'_> {
                     &self.free_var_references,
                     self.var_graph,
                     attributes,
+                    self.define_process_cwd,
                 )
             },
             &self.fun_args_values,
@@ -1001,6 +1003,7 @@ pub async fn analyse_ecmascript_module_internal(
             origin,
             compile_time_info,
             var_graph: &var_graph,
+            define_process_cwd: !source.ident().path().await?.path.contains("/node_modules/"),
             fun_args_values: Default::default(),
             var_cache: Default::default(),
             first_import_meta: true,
@@ -2927,6 +2930,7 @@ async fn value_visitor(
     >,
     var_graph: &VarGraph,
     attributes: &ImportAttributes,
+    define_process_cwd: bool,
 ) -> Result<(JsValue, bool)> {
     let (mut v, modified) = value_visitor_inner(
         origin,
@@ -2935,6 +2939,7 @@ async fn value_visitor(
         free_var_references,
         var_graph,
         attributes,
+        define_process_cwd,
     )
     .await?;
     v.normalize_shallow();
@@ -2951,6 +2956,7 @@ async fn value_visitor_inner(
     >,
     var_graph: &VarGraph,
     attributes: &ImportAttributes,
+    define_process_cwd: bool,
 ) -> Result<(JsValue, bool)> {
     let ImportAttributes { ignore, .. } = *attributes;
     // This check is just an optimization
@@ -3076,7 +3082,8 @@ async fn value_visitor_inner(
             v.into_unknown(true, "cross function analyzing is not yet supported")
         }
         _ => {
-            let (mut v, mut modified) = replace_well_known(v, compile_time_info).await?;
+            let (mut v, mut modified) =
+                replace_well_known(v, compile_time_info, define_process_cwd).await?;
             modified = replace_builtin(&mut v) || modified;
             modified = modified || v.make_nested_operations_unknown();
             return Ok((v, modified));

-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +{
 +  "name": "foo",
 +  "version": "0.0.0"
 +}
Original file line number	Diff line number	Diff line change
`@@ -3747,7 +3747,7 @@ pub mod test_utils {`
`3747`	`3747`	`}`
`3748`	`3748`	`}`
`3749`	`3749`	`_ => {`
`3750`		`- let (mut v, m1) = replace_well_known(v, compile_time_info).await?;`
	`3750`	`+ let (mut v, m1) = replace_well_known(v, compile_time_info, true).await?;`
`3751`	`3751`	`let m2 = replace_builtin(&mut v);`
`3752`	`3752`	`let m = m1 \|\| m2 \|\| v.make_nested_operations_unknown();`
`3753`	`3753`	`return Ok((v, m));`