@bytecodealliance/preview3-shim 0.7.0 → 0.8.0

package/dist/nodejs/filesystem/descriptor.js

@@ -872,6 +872,15 @@ class Descriptor {
      * Resolve a relative subpath against this descriptor.
      */
     #getFullPath(subpath, _followSymlinks) {
+        const segments = this.#normalizeSubpath(subpath);
+        const base = this.#hostPreopen ?? this.#fullPath;
+        if (segments.length === 0) {
+            return base;
+        }
+        const baseNormalized = stripTrailingSlash(base);
+        return `${baseNormalized}/${segments.join("/")}`;
+    }
+    #normalizeSubpath(subpath) {
         subpath = subpath.replaceAll("\\", "/").replace(/\/\/+/g, "/");
         if (subpath === "") {
             throw new FSError("no-entry");
@@ -894,12 +903,7 @@ class Descriptor {
                 segments.push(seg);
             }
         }
-        const base = this.#hostPreopen ?? this.#fullPath;
-        if (segments.length === 0) {
-            return base;
-        }
-        const baseNormalized = stripTrailingSlash(base);
-        return `${baseNormalized}/${segments.join("/")}`;
+        return segments;
     }
     async #statForIdentity() {
         if (this.#hostPreopen) {
@@ -916,19 +920,12 @@ class Descriptor {
         }
         const base = this.#hostPreopen ?? this.#fullPath;
         const baseResolved = nodePath.resolve(base);
-        const segments = subpath.replaceAll("\\", "/").replace(/\/\/+/g, "/").split("/");
+        // Validate the same normalized path that the filesystem operation will use.
+        // Otherwise an ENOENT segment followed by `..` can stop validation before a
+        // surviving symlink that #getFullPath later exposes.
+        const segments = this.#normalizeSubpath(subpath);
         let current = baseResolved;
         for (const seg of segments) {
-            if (seg === "" || seg === ".") {
-                continue;
-            }
-            if (seg === "..") {
-                current = nodePath.dirname(current);
-                if (!isWithinPath(baseResolved, current)) {
-                    throw new FSError("not-permitted");
-                }
-                continue;
-            }
             current = nodePath.join(current, seg);
             let stat;
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bytecodealliance/preview3-shim",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "WASI Preview3 shim for JS environments",
   "homepage": "https://github.com/bytecodealliance/jco/blob/main/packages/preview3-shim/#readme",
   "bugs": {
@@ -49,7 +49,7 @@
   },
   "dependencies": {
     "@bytecodealliance/jco-node-fs": "0.3.2",
-    "@bytecodealliance/preview2-shim": "^0.26.0"
+    "@bytecodealliance/preview2-shim": "^0.27.0"
   },
   "devDependencies": {
     "@bytecodealliance/jco": "1.25.2",