@nikovirtala/projen-constructs 0.3.66 → 0.3.68

package/node_modules/@jsii/spec/lib/assembly-utils.js

@@ -114,6 +114,12 @@ function writeAssembly(directory, assembly, { compress = false } = {}) {
     }
     return compress;
 }
+/**
+ * The maximum number of `jsii/file-redirect` hops followed when loading an
+ * assembly. The jsii compiler only ever emits a single redirect (to the
+ * compressed assembly), so this leaves ample headroom while preventing loops.
+ */
+const MAX_ASSEMBLY_REDIRECTS = 5;
 const failNoReadfileProvided = (filename) => {
     throw new Error(`Unable to load assembly support file ${JSON.stringify(filename)}: no readFile callback provided!`);
 };
@@ -129,7 +135,11 @@ const failNoReadfileProvided = (filename) => {
 function loadAssemblyFromBuffer(assemblyBuffer, readFile = failNoReadfileProvided, validate = true, supportedFeatures = []) {
     let contents = JSON.parse(assemblyBuffer.toString('utf-8'));
     // check if the file holds instructions to the actual assembly file
+    let redirects = 0;
     while ((0, redirect_1.isAssemblyRedirect)(contents)) {
+        if (++redirects > MAX_ASSEMBLY_REDIRECTS) {
+            throw new Error(`Too many assembly redirects (more than ${MAX_ASSEMBLY_REDIRECTS})`);
+        }
         contents = followRedirect(contents, readFile);
     }
     // Do feature checking *before* validating using JSONSchema, and do it always.
@@ -166,15 +176,43 @@ function loadAssemblyFromPath(directory, validate = true, supportedFeatures) {
 function loadAssemblyFromFile(pathToFile, validate = true, supportedFeatures) {
     const data = fs.readFileSync(pathToFile);
     try {
-        return loadAssemblyFromBuffer(data, (filename) => fs.readFileSync(path.resolve(pathToFile, '..', filename)), validate, supportedFeatures);
+        return loadAssemblyFromBuffer(data, (filename) => readSupportFile(path.dirname(pathToFile), filename), validate, supportedFeatures);
     }
     catch (e) {
         throw new Error(`Error loading assembly from file ${pathToFile}:\n${e}`);
     }
 }
+/**
+ * Reads an assembly support file, making sure it is located inside `directory`
+ * (after resolving any symbolic links).
+ */
+function readSupportFile(directory, filename) {
+    const realDir = fs.realpathSync(directory);
+    const realFile = fs.realpathSync(path.resolve(realDir, filename));
+    const relative = path.relative(realDir, realFile);
+    if (relative === '' ||
+        relative === '..' ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        throw new Error(`Assembly redirect target ${JSON.stringify(filename)} resolves outside of ${directory}`);
+    }
+    return fs.readFileSync(realFile);
+}
+/**
+ * Lexically checks that a redirect `filename` is a relative path that does not
+ * escape the directory containing the redirect.
+ */
+function assertRelativeRedirectFilename(filename) {
+    if (path.posix.isAbsolute(filename) ||
+        path.win32.isAbsolute(filename) ||
+        filename.split(/[\\/]/).includes('..')) {
+        throw new Error(`Invalid assembly redirect filename ${JSON.stringify(filename)}: must be a relative path inside the package`);
+    }
+}
 function followRedirect(assemblyRedirect, readFile) {
     // Validating the schema, this is cheap (the schema is small).
     (0, redirect_1.validateAssemblyRedirect)(assemblyRedirect);
+    assertRelativeRedirectFilename(assemblyRedirect.filename);
     let data = readFile(assemblyRedirect.filename);
     switch (assemblyRedirect.compression) {
         case 'gzip':

package/node_modules/@jsii/spec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsii/spec",
-  "version": "1.141.0",
+  "version": "1.142.0",
   "description": "Specification for jsii assemblies",
   "license": "Apache-2.0",
   "author": {
@@ -34,8 +34,8 @@
     "ajv": "^8.20.0",
     "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
-    "jest": "^30.5.1",
-    "jsii-build-tools": "^1.141.0",
+    "jest": "^30.5.2",
+    "jsii-build-tools": "^1.142.0",
     "typescript": "6.x",
     "typescript-json-schema": "^0.68.0"
   }

package/package.json

@@ -12,7 +12,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5",
-    "@jsii/spec": "^1.141.0",
+    "@jsii/spec": "^1.142.0",
     "@mrgrain/cdk-esbuild": "5.8.5",
     "@types/node": "^24",
     "@vitest/coverage-v8": "^4",
@@ -20,11 +20,11 @@
     "constructs": "^10.8.1",
     "esbuild": "^0.28.2",
     "jsii": "~6.0.3",
-    "jsii-diff": "^1.141.0",
+    "jsii-diff": "^1.142.0",
     "jsii-docgen": "^10.5.0",
-    "jsii-pacmak": "^1.141.0",
+    "jsii-pacmak": "^1.142.0",
     "jsii-rosetta": "~6.0.3",
-    "projen": "^0.104.9",
+    "projen": "^0.104.12",
     "tsx": "^4.23.15",
     "typedoc": "^0.28",
     "typescript": "6.0.3",
@@ -33,19 +33,19 @@
   "peerDependencies": {
     "@mrgrain/cdk-esbuild": "^5.8.5",
     "constructs": "^10.8.1",
-    "projen": "^0.104.9"
+    "projen": "^0.104.12"
   },
   "dependencies": {
     "@mrgrain/jsii-struct-builder": "^0.7.64",
     "case": "^1.6.3",
-    "projen": "^0.104.9"
+    "projen": "^0.104.12"
   },
   "bundledDependencies": [
     "@mrgrain/jsii-struct-builder",
     "case"
   ],
   "engines": {
-    "node": ">= 24.22.0"
+    "node": ">= 24.22.1"
   },
   "devEngines": {
     "packageManager": {
@@ -60,7 +60,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.3.66",
+  "version": "0.3.68",
   "types": "lib/index.d.ts",
   "jsii": {
     "outdir": "dist",