Relative paths outside project

2 files changed, 9 insertions, 3 deletions

diff --git a/src/install/dependency.zig b/src/install/dependency.zig
index 9e0e64736..8e862af97 100644
--- a/src/install/dependency.zig
+++ b/src/install/dependency.zig
@@ -539,7 +539,12 @@ pub fn parseWithTag(
         .folder => {
             if (strings.indexOf(dependency, ":")) |protocol| {
                 if (strings.eqlComptime(dependency[0..protocol], "file")) {
-                    return Version{ .literal = sliced.value(), .value = .{ .folder = sliced.sub(dependency[4..]).value() }, .tag = .folder };
+                    if (dependency.len <= protocol) {
+                        if (log_) |log| log.addErrorFmt(null, logger.Loc.Empty, allocator, "file: dependency missing a path", .{dependency}) catch unreachable;
+                        return null;
+                    }
+                    
+                    return Version{ .literal = sliced.value(), .value = .{ .folder = sliced.sub(dependency[protocol + 1 ..]).value() }, .tag = .folder };
                 }
 
                 if (log_) |log| log.addErrorFmt(null, logger.Loc.Empty, allocator, "Unsupported protocol {s}", .{dependency}) catch unreachable;
diff --git a/src/install/install.zig b/src/install/install.zig
index e046d506f..7ce829714 100644
--- a/src/install/install.zig
+++ b/src/install/install.zig
@@ -4107,7 +4107,7 @@ pub const PackageManager = struct {
             },
 
             .folder => {
-                const res = FolderResolution.getOrPut(name.slice(this.lockfile.buffers.string_bytes.items), this);
+                const res = FolderResolution.getOrPut(version.value.folder.slice(this.lockfile.buffers.string_bytes.items), this);
 
                 switch (res) {
                     .err => |err| return err,
@@ -6259,7 +6259,8 @@ pub const PackageManager = struct {
                         }
                     }
                 },
-                // TODO: support folder links higher than node_modules folder
+                // TODO: support folder links deeper than node_modules folder
+                // if node_modules/foo/package.json has a folder:, then this will not create a valid symlink
                 .folder => {
                     var folder_buf: [std.fs.MAX_PATH_BYTES]u8 = undefined;
                     std.mem.copy(u8, &folder_buf, "../" ++ std.fs.path.sep_str);