Skip to content

Commit

Permalink
Showing 2 changed files with 9 additions and 10 deletions.
9 changes: 4 additions & 5 deletions internal/node/node_patches.js
Original file line number Diff line number Diff line change
@@ -84,7 +84,7 @@ exports.patcher = (fs = fs$1, root, guards) => {
const origReadlinkSync = fs.readlinkSync.bind(fs);
const origReaddir = fs.readdir.bind(fs);
const origReaddirSync = fs.readdirSync.bind(fs);
const { isEscape, isOutPath } = exports.escapeFunction(root, guards);
const { isEscape } = exports.escapeFunction(root, guards);
// tslint:disable-next-line:no-any
fs.lstat = (...args) => {
let cb = args.length > 1 ? args[args.length - 1] : undefined;
@@ -95,8 +95,7 @@ exports.patcher = (fs = fs$1, root, guards) => {
if (err)
return cb(err);
const linkPath = path.resolve(args[0]);
// if this is not a symlink or the path is not inside the root it has no way to escape.
if (!stats.isSymbolicLink() || !root || isOutPath(linkPath)) {
if (!stats.isSymbolicLink()) {
return cb(null, stats);
}
return origReadlink(args[0], (err, str) => {
@@ -197,9 +196,9 @@ exports.patcher = (fs = fs$1, root, guards) => {
fs.lstatSync = (...args) => {
const stats = origLstatSync(...args);
const linkPath = path.resolve(args[0]);
// if this is not a symlink or the path is not inside the root it has no way to escape.
if (!stats.isSymbolicLink() || isOutPath(linkPath))
if (!stats.isSymbolicLink()) {
return stats;
}
let linkTarget;
try {
linkTarget = path.resolve(path.dirname(args[0]), origReadlinkSync(linkPath));
10 changes: 5 additions & 5 deletions packages/node-patches/src/fs.ts
Original file line number Diff line number Diff line change
@@ -55,7 +55,7 @@ export const patcher = (fs: any = _fs, root: string, guards: string[]) => {
const origReaddir = fs.readdir.bind(fs);
const origReaddirSync = fs.readdirSync.bind(fs);

const {isEscape, isOutPath} = escapeFunction(root, guards);
const {isEscape} = escapeFunction(root, guards);

const logged: {[k: string]: boolean} = {};

@@ -74,8 +74,7 @@ export const patcher = (fs: any = _fs, root: string, guards: string[]) => {
if (err) return cb(err);

const linkPath = path.resolve(args[0]);
// if this is not a symlink or the path is not inside the root it has no way to escape.
if (!stats.isSymbolicLink() || !root || isOutPath(linkPath)) {
if (!stats.isSymbolicLink()) {
return cb(null, stats);
}

@@ -177,8 +176,9 @@ export const patcher = (fs: any = _fs, root: string, guards: string[]) => {
fs.lstatSync = (...args: any[]) => {
const stats = origLstatSync(...args);
const linkPath = path.resolve(args[0]);
// if this is not a symlink or the path is not inside the root it has no way to escape.
if (!stats.isSymbolicLink() || isOutPath(linkPath)) return stats;
if (!stats.isSymbolicLink()) {
return stats;
}
let linkTarget: string;
try {
linkTarget = path.resolve(path.dirname(args[0]), origReadlinkSync(linkPath));

0 comments on commit b0627be

Please sign in to comment.