feat: prevent symbolic link following

src/helpers/cli.ts

@@ -57,6 +57,11 @@ const args: ICLIArgument[] = [
     type: 'string',
     description: 'Target file(s) to upload',
   },
+  {
+    name: 'preventSymbolicLinks',
+    type: 'boolean',
+    description: 'Specifies whether to prevent following of symbolic links. Defaults to false (symbolic links are followed).'
+  },
   {
     name: 'fullReport',
     type: 'string',

src/helpers/files.ts

@@ -197,6 +197,7 @@ const isNegated = (path: string) => path.startsWith('!')
 export async function getCoverageFiles(
   projectRoot: string,
   coverageFilePatterns: string[],
+  followSymbolicLinks: boolean = true,
 ): Promise<string[]> {
   const globstar = (pattern: string) => `**/${pattern}`
 
@@ -214,6 +215,7 @@ export async function getCoverageFiles(
   }), {
     cwd: projectRoot,
     dot: true,
+    followSymbolicLinks,
     ignore: getBlocklist(),
     suppressErrors: true,
   })

src/index.ts

@@ -223,6 +223,7 @@ export async function main(
 
     coverageFilePaths = requestedPaths
 
+
     if (!args.feature || args.feature.split(',').includes('search') === false) {
       info('Searching for coverage files...')
       const isNegated = (path: string) => path.startsWith('!')
@@ -237,6 +238,7 @@ export async function main(
             return coverageFilePaths.concat(coverageFilePatterns())
           }
         })(),
+        !args.preventSymbolicLinks,
       ))
 
       // Generate what the file listing would be after the blocklist is applied

src/types.ts

@@ -23,6 +23,7 @@ export interface UploaderArgs {
   nonZero?: string // Should errors exit with a non-zero (default: false)
   parent?: string // The commit SHA of the parent for which you are uploading coverage.
   pr?: string // Specify the pull request number manually
+  preventSymbolicLinks?: string // Specifies whether to prevent following of symoblic links
   rootDir?: string // Specify the project root directory when not in a git repo
   sha?: string // Specify the commit SHA manually
   slug: string // Specify the slug manually