@jeffusion/bungee-types 4.5.0 → 4.6.0

package/dist/daemon-file.js

@@ -52,6 +52,28 @@ function contained(parent, child, platform) {
     const target = comparePath(child, platform);
     return target !== root && target.startsWith(`${root}/`);
 }
+function withoutWindowsNamespacePrefix(value) {
+    return value.replace(/^\\\\\?\\UNC\\/i, '\\\\').replace(/^\\\\\?\\/i, '');
+}
+async function windowsContainmentDiagnostic(root, target, canonical, initial) {
+    let lstatState = 'error';
+    let identityState = 'unavailable';
+    let linkState = 'unavailable';
+    try {
+        const current = await lstat(target);
+        lstatState = current.isSymbolicLink() ? 'symlink' : current.isFile() ? 'regular' : 'non_regular';
+        identityState = sameIdentity(identity(initial), identity(current)) ? 'same' : 'changed';
+        linkState = current.nlink === 0 ? 'zero' : current.nlink === 1 ? 'single' : 'multiple';
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            lstatState = 'missing';
+    }
+    const namespaceState = comparePath(withoutWindowsNamespacePrefix(canonical), 'win32')
+        === comparePath(withoutWindowsNamespacePrefix(join(root, METADATA_FILENAME)), 'win32')
+        ? 'equivalent' : 'different';
+    return `metadata file escaped the runtime root; windows_realpath_containment=escaped lstat=${lstatState} identity=${identityState} nlink=${linkState} namespace_prefix=${namespaceState}`;
+}
 function sameIdentity(left, right) {
     return left.dev === right.dev && left.ino === right.ino;
 }
@@ -190,8 +212,14 @@ async function secureTarget(targetPath, options, mustExist) {
             await ensureWindowsAcl(target, options.windowsAcl ?? defaultWindowsAclAdapter(), 'file', options);
         testStage(options, 'target_realpath');
         const canonical = await realpath(target);
-        if (!contained(canonicalRoot, canonical, platform))
+        if (!contained(canonicalRoot, canonical, platform)) {
+            if (platform === 'win32') {
+                const error = new DaemonFileError('containment', 'metadata file escaped the runtime root');
+                error.message = await windowsContainmentDiagnostic(canonicalRoot, target, canonical, item);
+                throw error;
+            }
             fail('containment', 'metadata file escaped the runtime root');
+        }
         return { root: canonicalRoot, target, initial: identity(item) };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee-types",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "TypeScript type definitions for Bungee",
   "type": "module",
   "main": "./dist/index.js",