fix: validate plugin.package (#244)

Author: atian25

lib/loader/mixin/plugin.js

@@ -1,5 +1,6 @@
 'use strict';
 
+const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
 const debug = require('debug')('egg-core:plugin');
@@ -331,6 +332,10 @@ module.exports = {
       return plugin.path;
     }
 
+    if (plugin.package) {
+      assert(isValidatePackageName(plugin.package), `plugin ${plugin.name} invalid, use 'path' instead of package: "${plugin.package}"`);
+    }
+
     const name = plugin.package || plugin.name;
     const lookupDirs = new Set();
 
@@ -399,3 +404,11 @@ function depCompatible(plugin) {
     delete plugin.dep;
   }
 }
+
+function isValidatePackageName(name) {
+  // only check file path style
+  if (name.startsWith('.')) return false;
+  if (name.startsWith('/')) return false;
+  if (name.includes(':')) return false;
+  return true;
+}

test/loader/mixin/load_plugin.test.js

@@ -261,6 +261,29 @@ describe('test/load_plugin.test.js', function() {
     assert(!loader.allPlugins.h);
   });
 
+  it('should validate plugin.package', function() {
+    assert.throws(() => {
+      app = utils.createApp('plugin', { plugins: { foo: { package: '../' }, bar: { package: 'c:\\' } } });
+      const loader = app.loader;
+      loader.loadPlugin();
+      loader.loadConfig();
+    }, /plugin foo invalid, use 'path' instead of package/);
+
+    assert.throws(() => {
+      app = utils.createApp('plugin', { plugins: { foo: { package: 'c:\\' } } });
+      const loader = app.loader;
+      loader.loadPlugin();
+      loader.loadConfig();
+    }, /plugin foo invalid, use 'path' instead of package/);
+
+    assert.throws(() => {
+      app = utils.createApp('plugin', { plugins: { foo: { package: '/home' } } });
+      const loader = app.loader;
+      loader.loadPlugin();
+      loader.loadConfig();
+    }, /plugin foo invalid, use 'path' instead of package/);
+  });
+
   it('should throw when plugin not exist', function() {
     assert.throws(() => {
       app = utils.createApp('plugin-noexist');