fix: ban emitFile via absolute paths on Windows OS (#3509)

Co-authored-by: Lukas Taegert-Atkinson <lukastaegert@users.noreply.github.com>

src/utils/relativeId.ts

@@ -16,6 +16,7 @@ export function isPlainPathFragment(name: string) {
 	return (
 		name[0] !== '/' &&
 		!(name[0] === '.' && (name[1] === '/' || name[1] === '.')) &&
-		sanitizeFileName(name) === name
+		sanitizeFileName(name) === name &&
+		!isAbsolute(name)
 	);
 }

test/function/samples/emit-file/invalid-asset-name3/_config.js

@@ -0,0 +1,19 @@
+module.exports = {
+	description: 'throws for invalid asset names with absolute path on Windows OS',
+	options: {
+		plugins: {
+			name: 'test-plugin',
+			buildStart() {
+				this.emitFile({ type: 'asset', name: 'F:\\test.ext', source: 'content' });
+			}
+		}
+	},
+	error: {
+		code: 'PLUGIN_ERROR',
+		hook: 'buildStart',
+		message:
+			'The "fileName" or "name" properties of emitted files must be strings that are neither absolute nor relative paths and do not contain invalid characters, received "F:\\test.ext".',
+		plugin: 'test-plugin',
+		pluginCode: 'VALIDATION_ERROR'
+	}
+};

test/function/samples/emit-file/invalid-asset-name3/main.js

@@ -0,0 +1 @@
+throw new Error('should not build');