fix: file() referencing function outside project.

Signed-off-by: i4k <[email protected]>

stack/manager_test.go

@@ -204,6 +204,17 @@ func TestListChangedStacks(t *testing.T) {
 				changed: []string{"/stack1"},
 			},
 		},
+		{
+			name: "opening file outside repo to read, ignores the file and give a warning",
+			repobuilder: func(t *testing.T) repository {
+				t.Helper()
+				return singleTerragruntStackWithDependentOnFileOutsideRepo(t, "force")
+			},
+			want: listTestResult{
+				list:    []string{"/stack1", "/stack2"},
+				changed: []string{},
+			},
+		},
 		{
 			name: "single Terragrunt stack with single local Terraform module changed referenced with abspath",
 			repobuilder: func(t *testing.T) repository {
@@ -846,6 +857,66 @@ func singleTerragruntStackWithDependentOnFileChangedRepo(t *testing.T, enabledOp
 	return repo
 }
 
+func singleTerragruntStackWithDependentOnFileOutsideRepo(t *testing.T, enabledOption string) repository {
+	repo := singleMergeCommitRepoNoStack(t)
+	test.WriteFile(t, repo.Dir, "terramate.tm.hcl", Doc(
+		Block("terramate",
+			Block("config",
+				Block("change_detection",
+					Block("terragrunt",
+						Str("enabled", enabledOption),
+					),
+				),
+			),
+		),
+	).String())
+
+	test.WriteFile(t, filepath.Dir(repo.Dir), "hello.txt", "good world")
+
+	stack1 := test.Mkdir(t, repo.Dir, "stack1")
+	stack2 := test.Mkdir(t, repo.Dir, "stack2")
+
+	modules := test.Mkdir(t, repo.Dir, "modules")
+	module1 := test.Mkdir(t, modules, "module1")
+
+	repo.modules = append(repo.modules, module1)
+
+	root, err := config.LoadRoot(repo.Dir)
+	assert.NoError(t, err)
+
+	createStack(t, root, stack1)
+	createStack(t, root, stack2)
+
+	test.WriteFile(t, stack1, "terragrunt.hcl", Doc(
+		Block("terraform",
+			Str("source", "../modules/module1"),
+		),
+		Block("locals",
+			Expr("hello", `file("../../hello.txt")`),
+		),
+	).String())
+
+	test.WriteFile(t, module1, "main.tf", `# empty file`)
+
+	g := test.NewGitWrapper(t, repo.Dir, []string{})
+	assert.NoError(t, g.Checkout("testbranch", true), "create branch failed")
+
+	assert.NoError(t, g.Add(repo.Dir), "add files")
+	assert.NoError(t, g.Commit("files"), "commit files")
+
+	addMergeCommit(t, repo.Dir, "testbranch")
+	assert.NoError(t, g.DeleteBranch("testbranch"), "delete testbranch")
+
+	// now we branch again and modify the hello.txt
+	assert.NoError(t, g.Checkout("testbranch2", true), "create branch testbranch2 failed")
+
+	test.WriteFile(t, filepath.Dir(repo.Dir), "hello.txt", `evil world`)
+	test.WriteFile(t, repo.Dir, "bleh.txt", `anything just to have a commit`)
+	assert.NoError(t, g.Add(repo.Dir), "add files")
+	assert.NoError(t, g.Commit("hello changed"), "commit files")
+	return repo
+}
+
 func singleTerragruntStackWithSingleTerraformModuleChangedFromAbsPathSourceRepo(t *testing.T, enabledOption string) repository {
 	repo := singleMergeCommitRepoNoStack(t)
 	test.WriteFile(t, repo.Dir, "terramate.tm.hcl", Doc(

tg/funcs.go

@@ -29,10 +29,13 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	tmerrors "github.com/terramate-io/terramate/errors"
+
 	"github.com/gruntwork-io/go-commons/errors"
 	tgconfig "github.com/gruntwork-io/terragrunt/config"
 	"github.com/gruntwork-io/terragrunt/util"
 	"github.com/mitchellh/go-homedir"
+	"github.com/terramate-io/terramate/printer"
 	"github.com/terramate-io/terramate/project"
 	"github.com/zclconf/go-cty/cty"
 	"github.com/zclconf/go-cty/cty/function"
@@ -236,7 +239,13 @@ func tgFileFuncImpl(_ *tgconfig.ParsingContext, rootdir string, mod *Module) fun
 			if !filepath.IsAbs(path) {
 				path = filepath.Join(basedir, path)
 			}
-			mod.DependsOn = append(mod.DependsOn, project.PrjAbsPath(rootdir, path))
+			if path != rootdir && !strings.HasPrefix(path, rootdir+string(filepath.Separator)) {
+				printer.Stderr.WarnWithDetails("Terramate change detection cannot track files outside the project. Ignoring",
+					tmerrors.E("The file(%q) is outside project root %q", path, rootdir),
+				)
+			} else {
+				mod.DependsOn = append(mod.DependsOn, project.PrjAbsPath(rootdir, path))
+			}
 			src, err := readFileBytes(basedir, path)
 			if err != nil {
 				err = function.NewArgError(0, err)