Description: Enabling --legacy_external_runfiles and --allow_unresolved_symlinks can weaken build/test
hermeticity and symlink safety (especially on Windows runfiles trees), potentially
allowing malicious or unintended symlinked/dangling paths to be resolved at runtime and
access unexpected files outside the intended runfiles/sandbox, which warrants verification
in your CI and developer environments.
.bazelrc [13-45]

# Bazel 8 compatibility flags. We should find ways to avoid needing these
common --legacy_external_runfiles

# Ensure Windows support is accurate.
startup --windows_enable_symlinks
build --enable_runfiles

build --flag_alias=pin_browsers=//common:pin_browsers
build --flag_alias=headless=//common:headless

# Set the default java toolchain
build --java_language_version=21
build --java_runtime_version=remotejdk_21
build --tool_java_language_version=21
build --tool_java_runtime_version=remotejdk_21

# We target java 11 by default
build --javacopt="--release 11"

# Require java dependencies to be used and first-order
build --experimental_strict_java_deps=strict


 ... (clipped 12 lines)

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

The suggestion recommends replacing a fragile code-level workaround for Windows
symlink issues with a more robust solution in the Bazel build configuration.
This avoids relying on Node.js module caching behavior.

Examples:

// Pre-load minimatch before google-closure-deps to work around Windows symlink
// issues in Bazel's runfiles tree. When using pnpm-style node_modules layout
// with aspect_rules_js, transitive dependencies are linked via symlinks.
// On Windows, these symlinks may not resolve correctly. By requiring minimatch
// first, we populate Node's module cache so google-closure-deps can find it.
require('minimatch');

Solution Walkthrough:

Before:

// javascript/private/closure_make_deps_wrapper.js

// Pre-load minimatch before google-closure-deps to work around Windows symlink
// issues in Bazel's runfiles tree. When using pnpm-style node_modules layout
// with aspect_rules_js, transitive dependencies are linked via symlinks.
// On Windows, these symlinks may not resolve correctly. By requiring minimatch
// first, we populate Node's module cache so google-closure-deps can find it.
require('minimatch');

const closureMakeDeps = require('google-closure-deps').closureMakeDeps;

async function main() {
  // ...
}

After:

// javascript/private/closure_make_deps_wrapper.js

// The workaround of pre-loading 'minimatch' is removed.
// The root cause of the symlink issue should be addressed in Bazel
// configuration (e.g., node_modules layout, symlink settings)
// instead of this code-level patch.

const closureMakeDeps = require('google-closure-deps').closureMakeDeps;

async function main() {
  // ...
}

Remove the duplicate common --incompatible_enable_proto_toolchain_resolution
flag from .bazelrc to avoid redundancy and improve configuration clarity.

.bazelrc [61-71]

-# Required for prebuilt protoc to be used
+# Required for prebuilt protoc to be used, and for `rules_closure`
 common --incompatible_enable_proto_toolchain_resolution
 
 # Ensure that we don't accidentally build protobuf or gRPC
 common --per_file_copt=external/.*protobuf.*@--PROTOBUF_WAS_NOT_SUPPOSED_TO_BE_BUILT
 common --host_per_file_copt=external/.*protobuf.*@--PROTOBUF_WAS_NOT_SUPPOSED_TO_BE_BUILT
 common --per_file_copt=external/.*grpc.*@--GRPC_WAS_NOT_SUPPOSED_TO_BE_BUILT
 common --host_per_file_copt=external/.*grpc.*@--GRPC_WAS_NOT_SUPPOSED_TO_BE_BUILT
 
-# Required to get `protobuf` compiling, which is required for `rules_closure`
-common --incompatible_enable_proto_toolchain_resolution
-

• Apply / Chat