@homeflare/alchemy 0.53.1 → 0.55.0

package/dist/linux/index.js

@@ -3153,6 +3153,17 @@ var writeUnderPrefix = async (base, elevate, stage, path, bytes, options, mode)
 };
 
 // src/linux/sudo-runner.ts
+var BASE64 = "/usr/bin/base64";
+var checkPrivilegedReads = (paths = []) => {
+  for (const path of paths) {
+    const segments = path.split("/").slice(1);
+    if (!path.startsWith("/") || path.endsWith("/") || segments.some((segment) => segment === "" || segment === "." || segment === "..") || /[\0\n]/.test(path))
+      throw new SudoRefusedError(`sshSudoRunner: privilegedReads entry ${JSON.stringify(path)} is not a normalized absolute file path`);
+  }
+  return new Set(paths);
+};
+var decodeBase642 = (text) => new Uint8Array(Buffer.from(text.replaceAll(`
+`, ""), "base64"));
 var outsidePrefixHint = (path, prefixes) => (cause) => {
   const message = cause instanceof Error ? cause.message : String(cause);
   if (!/permission denied|operation not permitted/i.test(message))
@@ -3162,6 +3173,7 @@ var outsidePrefixHint = (path, prefixes) => (cause) => {
 var makeSshSudoRunner = (prefixList, deps) => {
   const prefixes = checkPrefixes(prefixList);
   const { base } = deps;
+  const readable = checkPrivilegedReads(deps.privilegedReads);
   const elevate = async (argv, context, before) => {
     const shown = JSON.stringify(argv);
     const problem = privilegedProblem2(argv, { prefixes, ...context });
@@ -3192,7 +3204,25 @@ var makeSshSudoRunner = (prefixList, deps) => {
     lookupUser: (nameOrId) => base.lookupUser(nameOrId),
     platform: base.platform,
     privileged: true,
-    readFile: (path) => base.readFile(path),
+    readFile: async (path) => {
+      if (!readable.has(path))
+        return base.readFile(path);
+      const stat = await base.stat(path);
+      if (stat === undefined)
+        return;
+      if (stat.kind !== "file" || stat.uid !== 0)
+        throw new SudoRefusedError(`sshSudoRunner refused a privileged read of ${path}: it is a ${stat.kind} owned by uid ` + `${String(stat.uid)}, and only a root-owned regular file is read as root`);
+      const argv = [BASE64, "--", path];
+      const shown = JSON.stringify(argv);
+      deps.log(`homeflare/linux sudo -n ${shown}`);
+      const result = await base.exec([SUDO, "-n", "--", ...argv]);
+      const refused = sudoRefusal(shown, result);
+      if (refused !== undefined)
+        throw refused;
+      if (result.exitCode !== 0)
+        throw new Error(`sudo -n ${shown} -> ${String(result.exitCode)}: ${result.stderr.trim().slice(0, 300)}`);
+      return decodeBase642(result.stdout);
+    },
     removeFile: async (path) => {
       const prefix = prefixOf(path, prefixes);
       if (prefix === undefined)
@@ -3230,6 +3260,7 @@ var sshSudoRunner = async (options) => {
   await checkProgramsExist(base, options.host);
   return makeSshSudoRunner(options.prefixes, {
     base,
+    ...options.privilegedReads === undefined ? {} : { privilegedReads: options.privilegedReads },
     log: options.log ?? ((line) => {
       process.stderr.write(`${line}
 `);
@@ -3262,5 +3293,5 @@ export {
   sshSudoRunner
 };
 
-//# debugId=DE197B18F4F6D7B664756E2164756E21
+//# debugId=2A7002C2A0EA54DD64756E2164756E21
 //# sourceMappingURL=index.js.map