Skip to content

fix(@angular/cli): serialize configuration as a single argv token in run_target strategies - #33657

Merged
alan-agius4 merged 2 commits into
angular:mainfrom
herdiyana256:fix-mcp-run-target-configuration-flag-injection
Aug 7, 2026
Merged

fix(@angular/cli): serialize configuration as a single argv token in run_target strategies#33657
alan-agius4 merged 2 commits into
angular:mainfrom
herdiyana256:fix-mcp-run-target-configuration-flag-injection

Conversation

@herdiyana256

Copy link
Copy Markdown
Contributor

build-target-strategy.ts, generic-target-strategy.ts, and unit-test-strategy.ts all pushed the configuration value as a separate argv element after '-c'. Since the ng CLI's argument parser does not consume a following token as the value of a string option when that token itself starts with a dash, a configuration value crafted to look like a flag (e.g. "--outputPath=...") is instead parsed as an independent, legitimately-declared option of the target's builder, silently overriding it.

Serialize configuration as a single '--configuration=value' token, matching the format serializeOptions() already uses for every other option, which is not affected by this because the value is bound to the key within one argv element.

Updated the two existing spec assertions that checked the old argv shape.

…run_target strategies

build-target-strategy.ts, generic-target-strategy.ts, and
unit-test-strategy.ts all pushed the configuration value as a separate
argv element after '-c'. Since the ng CLI's argument parser does not
consume a following token as the value of a string option when that
token itself starts with a dash, a configuration value crafted to look
like a flag (e.g. "--outputPath=...") is instead parsed as an
independent, legitimately-declared option of the target's builder,
silently overriding it.

Serialize configuration as a single '--configuration=value' token,
matching the format serializeOptions() already uses for every other
option, which is not affected by this because the value is bound to
the key within one argv element.

Updated the two existing spec assertions that checked the old argv
shape.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the target execution strategies (build, generic, and unit test) to use the long-form --configuration=value argument instead of the short-hand -c flag when constructing command-line arguments. The corresponding unit tests have also been updated to reflect this change. I have no feedback to provide as there are no review comments.

@geritzpatmar-max geritzpatmar-max left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@herdiyana256

Copy link
Copy Markdown
Contributor Author

Gentle bump, same as #33653. Open two weeks with no reviewer assigned, while #33654 from the same MCP batch was reviewed and merged within a few days, so this likely slipped past the queue.

Happy to rebase if it has gone stale. @clydin could you take a look, or point it at whoever owns the MCP run_target strategies?

@alan-agius4
alan-agius4 requested a review from clydin August 7, 2026 06:46
@alan-agius4 alan-agius4 added action: review The PR is still awaiting reviews from at least one requested reviewer target: patch This PR is targeted for the next patch release labels Aug 7, 2026
@clydin clydin added action: cleanup The PR is in need of cleanup, either due to needing a rebase or in response to comments from reviews and removed action: review The PR is still awaiting reviews from at least one requested reviewer labels Aug 7, 2026
@clydin

clydin commented Aug 7, 2026

Copy link
Copy Markdown
Member

Thank you for the contribution.
One file is out of format. Otherwise, LGTM.
Please correct the formatting and this can be merged.

@herdiyana256

Copy link
Copy Markdown
Contributor Author

Fixed, thanks for the review.

@alan-agius4 alan-agius4 added action: merge The PR is ready for merge by the caretaker merge: squash commits When the PR is merged, a squash and merge should be performed and removed action: cleanup The PR is in need of cleanup, either due to needing a rebase or in response to comments from reviews labels Aug 7, 2026
@alan-agius4
alan-agius4 removed the request for review from clydin August 7, 2026 14:42
@alan-agius4
alan-agius4 merged commit ecf8c08 into angular:main Aug 7, 2026
65 of 69 checks passed
@alan-agius4

Copy link
Copy Markdown
Collaborator

This PR was merged into the repository. The changes were merged into the following branches:

alan-agius4 pushed a commit that referenced this pull request Aug 7, 2026
…run_target strategies (#33657)

* fix(@angular/cli): serialize configuration as a single argv token in run_target strategies

build-target-strategy.ts, generic-target-strategy.ts, and
unit-test-strategy.ts all pushed the configuration value as a separate
argv element after '-c'. Since the ng CLI's argument parser does not
consume a following token as the value of a string option when that
token itself starts with a dash, a configuration value crafted to look
like a flag (e.g. "--outputPath=...") is instead parsed as an
independent, legitimately-declared option of the target's builder,
silently overriding it.

Serialize configuration as a single '--configuration=value' token,
matching the format serializeOptions() already uses for every other
option, which is not affected by this because the value is bound to
the key within one argv element.

Updated the two existing spec assertions that checked the old argv
shape.

* fix(@angular/cli): apply prettier formatting to unit-test-strategy_spec.ts

(cherry picked from commit ecf8c08)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: merge The PR is ready for merge by the caretaker area: @angular/cli merge: squash commits When the PR is merged, a squash and merge should be performed target: patch This PR is targeted for the next patch release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants