fix(unstable): disable importing from the vendor directory (#20067)

Some people might get think they need to import from this directory,
which could cause confusion and duplicate dependencies. Additionally,
the `vendor` directory has special behaviour in the language server, so
importing from the folder will definitely cause confusion and issues
there.

1 files changed, 38 insertions, 10 deletions

diff --git a/cli/resolver.rs b/cli/resolver.rs
index 6fa8eaabe..f78f31e8d 100644
--- a/cli/resolver.rs
+++ b/cli/resolver.rs
@@ -1,6 +1,7 @@
 // Copyright 2018-2023 the Deno authors. All rights reserved. MIT license.
 
 use deno_core::anyhow::anyhow;
+use deno_core::anyhow::bail;
 use deno_core::error::AnyError;
 use deno_core::futures::future;
 use deno_core::futures::future::LocalBoxFuture;
@@ -16,6 +17,7 @@ use deno_npm::registry::NpmRegistryApi;
 use deno_runtime::deno_node::is_builtin_node_module;
 use deno_semver::npm::NpmPackageReq;
 use import_map::ImportMap;
+use std::path::PathBuf;
 use std::sync::Arc;
 
 use crate::args::package_json::PackageJsonDeps;
@@ -102,6 +104,7 @@ pub struct CliGraphResolver {
   mapped_specifier_resolver: MappedSpecifierResolver,
   maybe_default_jsx_import_source: Option<String>,
   maybe_jsx_import_source_module: Option<String>,
+  maybe_vendor_specifier: Option<ModuleSpecifier>,
   no_npm: bool,
   npm_registry_api: Arc<CliNpmRegistryApi>,
   npm_resolution: Arc<NpmResolution>,
@@ -125,8 +128,9 @@ impl Default for CliGraphResolver {
         maybe_import_map: Default::default(),
         package_json_deps_provider: Default::default(),
       },
-      maybe_default_jsx_import_source: Default::default(),
-      maybe_jsx_import_source_module: Default::default(),
+      maybe_default_jsx_import_source: None,
+      maybe_jsx_import_source_module: None,
+      maybe_vendor_specifier: None,
       no_npm: false,
       npm_registry_api,
       npm_resolution,
@@ -137,27 +141,37 @@ impl Default for CliGraphResolver {
   }
 }
 
+pub struct CliGraphResolverOptions<'a> {
+  pub maybe_jsx_import_source_config: Option<JsxImportSourceConfig>,
+  pub maybe_import_map: Option<Arc<ImportMap>>,
+  pub maybe_vendor_dir: Option<&'a PathBuf>,
+  pub no_npm: bool,
+}
+
 impl CliGraphResolver {
   pub fn new(
-    maybe_jsx_import_source_config: Option<JsxImportSourceConfig>,
-    maybe_import_map: Option<Arc<ImportMap>>,
-    no_npm: bool,
     npm_registry_api: Arc<CliNpmRegistryApi>,
     npm_resolution: Arc<NpmResolution>,
     package_json_deps_provider: Arc<PackageJsonDepsProvider>,
     package_json_deps_installer: Arc<PackageJsonDepsInstaller>,
+    options: CliGraphResolverOptions,
   ) -> Self {
     Self {
       mapped_specifier_resolver: MappedSpecifierResolver {
-        maybe_import_map,
+        maybe_import_map: options.maybe_import_map,
         package_json_deps_provider,
       },
-      maybe_default_jsx_import_source: maybe_jsx_import_source_config
+      maybe_default_jsx_import_source: options
+        .maybe_jsx_import_source_config
         .as_ref()
         .and_then(|c| c.default_specifier.clone()),
-      maybe_jsx_import_source_module: maybe_jsx_import_source_config
+      maybe_jsx_import_source_module: options
+        .maybe_jsx_import_source_config
         .map(|c| c.module),
-      no_npm,
+      maybe_vendor_specifier: options
+        .maybe_vendor_dir
+        .and_then(|v| ModuleSpecifier::from_directory_path(v).ok()),
+      no_npm: options.no_npm,
       npm_registry_api,
       npm_resolution,
       package_json_deps_installer,
@@ -219,7 +233,7 @@ impl Resolver for CliGraphResolver {
     referrer: &ModuleSpecifier,
   ) -> Result<ModuleSpecifier, AnyError> {
     use MappedResolution::*;
-    match self
+    let result = match self
       .mapped_specifier_resolver
       .resolve(specifier, referrer)?
     {
@@ -232,7 +246,21 @@ impl Resolver for CliGraphResolver {
       }
       None => deno_graph::resolve_import(specifier, referrer)
         .map_err(|err| err.into()),
+    };
+
+    // When the user is vendoring, don't allow them to import directly from the vendor/ directory
+    // as it might cause them confusion or duplicate dependencies. Additionally, this folder has
+    // special treatment in the language server so it will definitely cause issues/confusion there
+    // if they do this.
+    if let Some(vendor_specifier) = &self.maybe_vendor_specifier {
+      if let Ok(specifier) = &result {
+        if specifier.as_str().starts_with(vendor_specifier.as_str()) {
+          bail!("Importing from the vendor directory is not permitted. Use a remote specifier instead or disable vendoring.");
+        }
+      }
     }
+
+    result
   }
 }