Dangerous behavior: setting output.distPath.root to "/" may delete system root directory

[sherry007]

Description

When configuring output.distPath.root as /, running rsbuild dev (or build) may result in deleting files under the system root directory.

This is extremely dangerous and can cause irreversible system damage (data loss, OS corruption).

In my case, this configuration caused large parts of my macOS system directories to be deleted, requiring a full OS reinstall.

---

Steps to Reproduce

1. Create a new rsbuild project
2. Configure:

// rsbuild.config.js
export default {
  output: {
    distPath: {
      root: '/',
    },
  },
};

3. run pnpm run dev

Expected Behavior

rsbuild should refuse to use dangerous root paths such as:

/

C:\

other system root directories

At minimum, rsbuild should throw an explicit error, for example:

Refusing to clean output directory "/". This path is unsafe.

Actual Behavior

rsbuild attempts to clean the output directory before starting dev/build.

When distPath.root is set to /, this leads to deletion attempts on the system root directory.

Why this is dangerous

Many users may confuse distPath.root with publicPath

Dev mode still performs output directory cleanup

There is currently no safeguard against critical filesystem paths

This behavior can easily affect experienced developers and is not an obvious misuse.

Suggested Fixes

One or more of the following safeguards would greatly improve safety:

Block /, C:, and other filesystem root paths explicitly

Ensure distPath.root must be inside the project directory by default

Require an explicit --force or dangerouslyAllowRootOutput flag

Add prominent documentation warnings

Environment

System:
OS: macOS 15.7
CPU: (8) arm64 Apple M3
Memory: 63.23 MB / 16.00 GB
Shell: 5.9 - /bin/zsh
Browsers:
Chrome: 143.0.7499.147
Safari: 18.6
npmPackages:
@rsbuild/core: ^1.3.6 => 1.3.16
@rsbuild/plugin-babel: ^1.0.6 => 1.0.6
@rsbuild/plugin-less: ^1.2.2 => 1.2.4
@rsbuild/plugin-react: ^1.2.0 => 1.3.0

[chenjiahan]

Rsbuild checks the output directory before cleaning, and the situation you described should not happen.

[chenjiahan]

We introduced support for this feature about a year ago, and we can't modify code in older releases. The only thing you need to do is upgrade to a newer version.

[malczak]

Seems like its still possible with "@rsbuild/core": "^1.6.3" on Macos. @chenjiahan was this behaviour changed in a later version?

[chenjiahan]

@malczak Could you provide a reproduction repo?

[malczak]

@chenjiahan sure mate.

Here an exact copy of rsbuild.config.ts -> https://github.com/malczak/rsbuild-fs-nuke
Version is pinned to Rsbuild v1.6.15 because this was a version I used when stumbled upon this

Note a configuration in line 123 when output.distPath.root is set there was a type made. Where ./ should be / was entered:

    output: {
      cleanDistPath: true,
      assetPrefix: "/js/editor/",
      distPath: {
        root: stage === "production" ? "../webpage/public/js/editor/" : "/", // <----- NUKING THE WHOLE FS
        js: "/js/editor/",
        jsAsync: "",
        css: "",
        cssAsync: "",
      },

node v22.15.0
zsh 5.9 (arm64-apple-darwin24.0)

--
ps. I didn't run this particular repo again, but it's a exact copy of the one that tried to clean my entire home folder

[chenjiahan]

Thanks, more checks will be added, see #7158