fix(commonjs): node_modules lookup depth limit to avoid infinite loops

packages/commonjs/README.md

@@ -345,6 +345,14 @@ For these situations, you can change Rollup's behaviour either globally or per m
 
 To change this for individual modules, you can supply a function for `requireReturnsDefault` instead. This function will then be called once for each required ES module or external dependency with the corresponding id and allows you to return different values for different modules.
 
+### nodeModulesLookupDepth
+
+Type: `number`<br>
+Default: `15`
+
+Max depth for `node_modules` lookup algorithm in the virtual `require` realm.
+This is here for safety, in case of a dynamic require to something that does not exist.
+
 ## Using with @rollup/plugin-node-resolve
 
 Since most CommonJS packages you are importing are probably dependencies in `node_modules`, you may need to use [@rollup/plugin-node-resolve](https://github.com/rollup/plugins/tree/master/packages/node-resolve):

packages/commonjs/src/helpers.js

@@ -58,7 +58,7 @@ export function commonjsRequire (path) {
 }
 `;
 
-const getDynamicHelpers = (ignoreDynamicRequires) => `
+const getDynamicHelpers = (ignoreDynamicRequires, nodeModulesLookupDepth) => `
 export function createModule(modulePath) {
 	return {
 		path: modulePath,
@@ -172,7 +172,8 @@ export function commonjsResolveImpl (path, originalModuleDir, testCache) {
 	if (path[0] === '/') {
 		originalModuleDir = '/';
 	}
-	while (true) {
+	let depth = 0;
+	while (depth++ < ${nodeModulesLookupDepth}) {
 		if (!shouldTryNodeModules) {
 			relPath = originalModuleDir ? normalize(originalModuleDir + '/' + path) : path;
 		} else if (originalModuleDir) {
@@ -181,10 +182,6 @@ export function commonjsResolveImpl (path, originalModuleDir, testCache) {
 			relPath = normalize(join('node_modules', path));
 		}
 
-		if (relPath.endsWith('/..')) {
-			break; // Travelled too far up, avoid infinite loop
-		}
-
 		for (let extensionIndex = 0; extensionIndex < CHECKED_EXTENSIONS.length; extensionIndex++) {
 			const resolvedPath = relPath + CHECKED_EXTENSIONS[extensionIndex];
 			if (DYNAMIC_REQUIRE_CACHE[resolvedPath]) {
@@ -257,8 +254,14 @@ commonjsRequire.cache = DYNAMIC_REQUIRE_CACHE;
 commonjsRequire.resolve = commonjsResolve;
 `;
 
-export function getHelpersModule(isDynamicRequireModulesEnabled, ignoreDynamicRequires) {
+export function getHelpersModule(
+  isDynamicRequireModulesEnabled,
+  ignoreDynamicRequires,
+  nodeModulesLookupDepth
+) {
   return `${HELPERS}${
-    isDynamicRequireModulesEnabled ? getDynamicHelpers(ignoreDynamicRequires) : HELPER_NON_DYNAMIC
+    isDynamicRequireModulesEnabled
+      ? getDynamicHelpers(ignoreDynamicRequires, nodeModulesLookupDepth)
+      : HELPER_NON_DYNAMIC
   }`;
 }

packages/commonjs/src/index.js

@@ -46,6 +46,7 @@ export default function commonjs(options = {}) {
   const {
     ignoreGlobal,
     ignoreDynamicRequires,
+    nodeModulesLookupDepth,
     requireReturnsDefault: requireReturnsDefaultOption,
     esmExternals
   } = options;
@@ -168,7 +169,11 @@ export default function commonjs(options = {}) {
 
     load(id) {
       if (id === HELPERS_ID) {
-        return getHelpersModule(isDynamicRequireModulesEnabled, ignoreDynamicRequires);
+        return getHelpersModule(
+          isDynamicRequireModulesEnabled,
+          ignoreDynamicRequires,
+          typeof nodeModulesLookupDepth === 'number' ? nodeModulesLookupDepth : 15
+        );
       }
 
       if (id.startsWith(HELPERS_ID)) {

packages/commonjs/test/fixtures/function/dynamic-require-alias-hack/_config.js

@@ -0,0 +1,9 @@
+module.exports = {
+  description: 'resolves both windows and posix paths',
+  pluginOptions: {
+    dynamicRequireTargets: [
+      'fixtures/function/dynamic-require-alias-hack/stub.js'
+    ],
+    ignoreDynamicRequires: true
+  }
+};

packages/commonjs/test/fixtures/function/dynamic-require-alias-hack/main.js

@@ -0,0 +1,9 @@
+/* eslint-disable global-require */
+// noinspection UnnecessaryLocalVariableJS
+
+// A hack used in many old libraries, saying "workaround to exclude package from browserify list."
+// Will bypass rollup-commonjs finding out that this is a require that should not go through the plugin, and will do an infinite search.
+let _require = require;
+let buffer = _require('buffer');
+
+t.is(buffer, require('buffer'));