@jeffusion/bungee 4.4.3 → 4.6.0

package/dist/index.js

@@ -2628,6 +2628,25 @@ function contained(parent, child, platform) {
   const target = comparePath(child, platform);
   return target !== root && target.startsWith(`${root}/`);
 }
+function withoutWindowsNamespacePrefix(value) {
+  return value.replace(/^\\\\\?\\UNC\\/i, "\\\\").replace(/^\\\\\?\\/i, "");
+}
+async function windowsContainmentDiagnostic(root, target, canonical, initial) {
+  let lstatState = "error";
+  let identityState = "unavailable";
+  let linkState = "unavailable";
+  try {
+    const current = await lstat(target);
+    lstatState = current.isSymbolicLink() ? "symlink" : current.isFile() ? "regular" : "non_regular";
+    identityState = sameIdentity(identity(initial), identity(current)) ? "same" : "changed";
+    linkState = current.nlink === 0 ? "zero" : current.nlink === 1 ? "single" : "multiple";
+  } catch (error) {
+    if (error.code === "ENOENT")
+      lstatState = "missing";
+  }
+  const namespaceState = comparePath(withoutWindowsNamespacePrefix(canonical), "win32") === comparePath(withoutWindowsNamespacePrefix(join(root, METADATA_FILENAME)), "win32") ? "equivalent" : "different";
+  return `metadata file escaped the runtime root; windows_realpath_containment=escaped lstat=${lstatState} identity=${identityState} nlink=${linkState} namespace_prefix=${namespaceState}`;
+}
 function sameIdentity(left, right) {
   return left.dev === right.dev && left.ino === right.ino;
 }
@@ -2758,8 +2777,14 @@ async function secureTarget(targetPath, options, mustExist) {
       await ensureWindowsAcl(target, options.windowsAcl ?? defaultWindowsAclAdapter(), "file", options);
     testStage(options, "target_realpath");
     const canonical = await realpath(target);
-    if (!contained(canonicalRoot, canonical, platform))
+    if (!contained(canonicalRoot, canonical, platform)) {
+      if (platform === "win32") {
+        const error = new DaemonFileError("containment", "metadata file escaped the runtime root");
+        error.message = await windowsContainmentDiagnostic(canonicalRoot, target, canonical, item);
+        throw error;
+      }
       fail2("containment", "metadata file escaped the runtime root");
+    }
     return { root: canonicalRoot, target, initial: identity(item) };
   } catch (error) {
     if (error.code !== "ENOENT" || mustExist)
@@ -3343,7 +3368,7 @@ import { createInterface } from "node:readline";
 // package.json
 var package_default = {
   name: "@jeffusion/bungee",
-  version: "4.4.3",
+  version: "4.6.0",
   description: "High-performance reverse proxy server CLI",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee",
-  "version": "4.4.3",
+  "version": "4.6.0",
   "description": "High-performance reverse proxy server CLI",
   "type": "module",
   "bin": {
@@ -13,8 +13,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@jeffusion/bungee-core": "^4.4.3",
-    "@jeffusion/bungee-types": "^4.4.3",
+    "@jeffusion/bungee-core": "^4.6.0",
+    "@jeffusion/bungee-types": "^4.6.0",
     "cli-progress": "^3.12.0",
     "commander": "^14.0.1"
   },