@ai-ecoverse/slicc-kernel 1.173.0 → 1.173.2

package/dist/node-process-worker.cjs

@@ -7513,7 +7513,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.173.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.173.2" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node-process-worker.js

@@ -7512,7 +7512,7 @@ var init_version = __esm({
   "src/version.ts"() {
     "use strict";
     init_captured_globals();
-    KERNEL_VERSION = true ? "1.173.0" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.173.2" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });

package/dist/node.js

@@ -3702,7 +3702,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.173.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.173.2" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -30649,7 +30649,20 @@ var RULE = new RegExp(
 );
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN3 = /^[A-Za-z0-9_@%+=:,./-]+$/;
+var CONTROL = /[\0-\x1f\x7f]/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
+function hasControl(text) {
+  return CONTROL.test(text);
+}
+function withoutControl(text) {
+  return text.replace(CONTROL, (ch) => {
+    const n = ch.charCodeAt(0);
+    if (n === 9) return "\\t";
+    if (n === 10) return "\\n";
+    if (n === 13) return "\\r";
+    return `\\x${n.toString(16).padStart(2, "0")}`;
+  });
+}
 function failed3(errno3, error) {
   return { error, errno: errno3 };
 }
@@ -30675,7 +30688,106 @@ function splitWords(text) {
   return words2;
 }
 function quoteWord(word) {
-  return PLAIN3.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`;
+  const text = hasControl(word) ? withoutControl(word) : word;
+  return PLAIN3.test(text) ? text : `'${text.replaceAll("'", `'\\''`)}'`;
+}
+function addPart(word, part) {
+  const last = word.length - 1;
+  if (part === null) {
+    if (word[last] !== null) word.push(null);
+  } else if (typeof word[last] === "string") word[last] += part;
+  else word.push(part);
+}
+function addPlain(word, plain3) {
+  for (const [i, part] of plain3.split("*").entries()) {
+    if (i > 0) addPart(word, null);
+    if (part !== "") addPart(word, part);
+  }
+}
+function splitPatterns(text) {
+  const piece = /'([^']*)'|"((?:[^"\\]|\\[\s\S])*)"|\\([\s\S])|([^\s'"\\]+)|(\s+)/y;
+  const words2 = [];
+  let word;
+  while (piece.lastIndex < text.length) {
+    const m = piece.exec(text);
+    if (!m) return void 0;
+    const [, single, double, escaped, plain3, space] = m;
+    if (space !== void 0) {
+      if (word !== void 0) words2.push(word);
+      word = void 0;
+      continue;
+    }
+    word ??= [];
+    if (plain3 !== void 0) addPlain(word, plain3);
+    else addPart(word, single ?? (double !== void 0 ? unescaped(double) : escaped));
+  }
+  if (word !== void 0) words2.push(word);
+  return words2;
+}
+var literal2 = (pattern) => pattern.map((p) => p ?? "*").join("");
+var isAny = (pattern) => pattern?.length === 1 && pattern[0] === null;
+function literalWord(word) {
+  if (!word.includes("*")) return quoteWord(word);
+  const bare = word.replaceAll("*", "");
+  return bare === "" || PLAIN3.test(bare) ? word.replaceAll("*", "\\*") : quoteWord(word);
+}
+function patternWord(pattern) {
+  if (pattern.length === 1 && typeof pattern[0] === "string") return literalWord(pattern[0]);
+  return pattern.map((p) => p === null ? "*" : literalWord(p)).join("");
+}
+function globMatch(items, subjects, star, one) {
+  let i = 0;
+  let j = 0;
+  let back = -1;
+  let from = 0;
+  while (j < subjects) {
+    if (i < items && star(i)) {
+      back = i++;
+      from = j;
+    } else if (i < items && one(i, j)) {
+      i++;
+      j++;
+    } else if (back >= 0) {
+      i = back + 1;
+      j = ++from;
+    } else return false;
+  }
+  while (i < items && star(i)) i++;
+  return i === items;
+}
+function wordMatch(pattern, arg) {
+  if (pattern.every((p) => p !== null)) return literal2(pattern) === arg;
+  const chars = pattern.flatMap((p) => p === null ? [null] : [...p]);
+  const subject = [...arg];
+  return globMatch(
+    chars.length,
+    subject.length,
+    (i) => chars[i] === null,
+    (i, j) => chars[i] === subject[j]
+  );
+}
+function commandMatches(cmnd, argv) {
+  if (cmnd === "*") return true;
+  const [path, ...args] = argv;
+  if (path !== cmnd.path) return false;
+  const want = cmnd.args;
+  if (want === void 0) return true;
+  return globMatch(
+    want.length,
+    args.length,
+    (i) => isAny(want[i]),
+    (i, j) => wordMatch(want[i], args[j])
+  );
+}
+function commandText(cmnd) {
+  const path = quoteWord(cmnd.path);
+  if (cmnd.args === void 0) return path;
+  if (cmnd.args.length === 0) return `${path} ""`;
+  return [path, ...cmnd.args.map(patternWord)].join(" ");
+}
+function recordedCommand(argv) {
+  const [path = "", ...args] = argv;
+  return commandText({ path, args: args.map((a) => [a]) });
 }
 function validWho(who) {
   if (who === "ALL") return true;
@@ -30697,9 +30809,23 @@ function parseRule(line) {
   if (cwd === "") return void 0;
   const rule = { nopasswd: !!nopasswd, who, target, ...cwd !== void 0 ? { cwd } : {} };
   if (rest2.trim() === "*") return { ...rule, cmnd: "*" };
-  const cmnd = splitWords(rest2);
-  if (!cmnd?.[0]?.startsWith("/")) return void 0;
-  return { ...rule, cmnd };
+  const words2 = splitPatterns(rest2);
+  const [first, ...args] = words2 ?? [];
+  const path = first ? literal2(first) : "";
+  if (!path.startsWith("/")) return void 0;
+  const only = args.length === 1 && args[0]?.length === 1 && args[0][0] === "";
+  if (only && /\s""$/.test(rest2.trim())) return { ...rule, cmnd: { path, args: [] } };
+  return { ...rule, cmnd: args.length === 0 ? { path } : { path, args } };
+}
+function recordedBare(line, file, rule) {
+  if (rule.cmnd === "*" || rule.cmnd.args !== void 0 || !rule.nopasswd) return false;
+  if (file !== `${SUDOERS_D}/${rule.who}` || !NAME3.test(rule.who) || !NAME3.test(rule.target)) {
+    return false;
+  }
+  const head = `NOPASSWD ${rule.who} (${rule.target}) `;
+  const cmnd = `Cmnd ${quoteWord(rule.cmnd.path)}`;
+  const cwd = rule.cwd === void 0 ? "" : `Cwd ${quoteWord(rule.cwd)} `;
+  return line.trimEnd() === `${head}${cwd}${cmnd}`;
 }
 function flags(parsed2, arg, next3) {
   for (let j = 1; j < arg.length; j++) {
@@ -30737,7 +30863,7 @@ function parseArgs(args) {
   return parsed2;
 }
 function described(rule) {
-  const cmnd = rule.cmnd === "*" ? "ALL" : rule.cmnd.map(quoteWord).join(" ");
+  const cmnd = rule.cmnd === "*" ? "ALL" : commandText(rule.cmnd);
   const cwd = rule.cwd === void 0 ? "" : `CWD=${quoteWord(rule.cwd)} `;
   return `    (${rule.target}) ${cwd}${rule.nopasswd ? "NOPASSWD: " : ""}${cmnd}`;
 }
@@ -30783,7 +30909,9 @@ var Sudo = class {
     const rules = [];
     for (const [n, line] of text.split("\n").entries()) {
       const rule = parseRule(line);
-      if (rule) rules.push(rule);
+      if (rule && recordedBare(line, path, rule) && rule.cmnd !== "*") {
+        rules.push({ ...rule, cmnd: { path: rule.cmnd.path, args: [] } });
+      } else if (rule) rules.push(rule);
       else if (rule === void 0) this.warn(`sudo: ${path}:${n + 1}: bad line skipped: ${line}`);
     }
     return rules;
@@ -30879,7 +31007,7 @@ var Sudo = class {
     if (untrusted2) return untrusted2;
     const argv = [path, ...args];
     const matching = rules.filter(
-      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && (rule.cmnd === "*" || rule.cmnd.length === argv.length && rule.cmnd.every((w, i) => w === argv[i]))
+      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && commandMatches(rule.cmnd, argv)
     );
     const grant = () => this.grant(self, target, cred, parsed2.command, path, cwd, call.term);
     if (root || matching.some((rule) => rule.nopasswd)) return grant();
@@ -30970,13 +31098,14 @@ ${lines2}
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
     if (!NAME3.test(self.name)) return false;
+    if (hasControl(cwd) || argv.some(hasControl)) return false;
     try {
       await this.provision();
       if (!await this.trusted(SUDOERS_D)) return false;
       const st = await fs.lstat(path).catch(() => void 0);
       if (st && !await this.trusted(path)) return false;
       const old = st ? await fs.readFile(path) : "";
-      const words2 = argv.map(quoteWord).join(" ");
+      const words2 = recordedCommand(argv);
       const line = `NOPASSWD ${self.name} (${target.name}) Cwd ${quoteWord(cwd)} Cmnd ${words2}
 `;
       const text = old === "" || old.endsWith("\n") ? `${old}${line}` : `${old}