test(@angular/build): add output path boundary checks

Author: CodeByMoriarty

packages/angular/build/src/builders/application/tests/options/output-path_spec.ts

@@ -260,6 +260,22 @@ describeBuilder(buildApplication, APPLICATION_BUILDER_INFO, (harness) => {
           }),
         );
       });
+
+      it('should error when the output path escapes the workspace root', async () => {
+        harness.useTarget('build', {
+          ...BASE_OPTIONS,
+          polyfills: [],
+          outputPath: '../dist',
+        });
+
+        const { result, error } = await harness.executeOnce({
+          outputLogsOnException: false,
+          outputLogsOnFailure: false,
+        });
+
+        expect(result).toBeUndefined();
+        expect(error?.message).toMatch(/must be inside the project root directory/);
+      });
     });
   });
 });

packages/angular/build/src/utils/delete-output-dir_spec.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright Google LLC All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.dev/license
+ */
+
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { deleteOutputDir } from './delete-output-dir';
+
+describe('deleteOutputDir', () => {
+    let workspaceRoot: string;
+
+    beforeEach(async () => {
+        workspaceRoot = await mkdtemp(join(tmpdir(), 'angular-cli-test-'));
+        await mkdir(join(workspaceRoot, 'dist'), { recursive: true });
+        await writeFile(join(workspaceRoot, 'dist', 'file.txt'), 'test');
+    });
+
+    afterEach(async () => {
+        await rm(workspaceRoot, { recursive: true, force: true });
+    });
+
+    it('should reject deleting the project root directory', async () => {
+        await expectAsync(deleteOutputDir(workspaceRoot, '.')).toBeRejectedWithError(
+            'Output path MUST not be project root directory!',
+        );
+    });
+
+    it('should reject deleting a path outside the project root', async () => {
+        await expectAsync(deleteOutputDir(workspaceRoot, '..')).toBeRejectedWithError(
+            new RegExp(`Output path '.*' MUST be inside the project root '${workspaceRoot}'.`),
+        );
+    });
+});