@blamejs/core 0.7.18 → 0.7.20

package/lib/static.js

@@ -168,19 +168,21 @@ function _resolveSafe(root, requestedPath) {
 
   // Symlink-escape defense — the lexical resolve above only sees the
   // requested path tokens; a symlink anywhere along `resolved` can
-  // still point outside `rootResolved` on disk. realpath every node
-  // (only when it exists; missing files are routed through the
-  // standard 404 path by the caller).
+  // still point outside `rootResolved` on disk. Compare via realpath
+  // for the escape check ONLY; do NOT substitute the realpath result
+  // for `resolved`. Substituting breaks downstream consumers that key
+  // on the lexical path (revoke list, ETag cache, audit row) AND
+  // breaks deploys where the OS prefix-symlinks the temp dir
+  // (macOS: /var/folders/X/Y → /private/var/folders/X/Y).
   try {
     var real = fs.realpathSync(resolved);
     var rootReal = fs.realpathSync(rootResolved);
     if (real !== rootReal && !real.startsWith(rootReal + path.sep)) return null;
-    resolved = real;
   } catch (_e) {
     // Path doesn't exist (or is denied) — fall through with the lexical
     // resolution so the caller's stat() returns the natural ENOENT and
     // 404s. realpath failures from non-existence are NOT a smuggling
-    // signal.
+    // signal; the lexical bound check above already rejected escapes.
   }
 
   // Filename safety — the basename gates against path-traversal /