@nissyai/desktop 0.2.19 → 0.2.25

package/bin/nissy.mjs

@@ -9,16 +9,18 @@
 import { execFileSync, spawn } from "node:child_process";
 import {
   existsSync,
+  lstatSync,
   mkdirSync,
   readdirSync,
   readFileSync,
+  realpathSync,
   renameSync,
   rmSync,
   writeFileSync,
 } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, isAbsolute, join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import {
@@ -28,6 +30,7 @@ import {
   npxChannelEnv,
   resolveLaunchCommand,
   resolvePayloadSpec,
+  unsafeArchiveEntries,
   UnsupportedPlatformError,
 } from "../src/resolve.mjs";
 import { DISTRIBUTION } from "../src/distribution.mjs";
@@ -39,6 +42,59 @@ function fail(message) {
   process.exit(1);
 }
 
+function validateArchive(archivePath, bundleName) {
+  const listing = execFileSync("tar", ["-tzf", archivePath], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "inherit"],
+  });
+  const entries = listing
+    .split(/\r?\n/u)
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0);
+  const unsafe = unsafeArchiveEntries(entries, bundleName);
+  if (unsafe.length > 0) {
+    throw new Error(
+      `payload archive contains unsafe entries: ${unsafe.slice(0, 5).join(", ")}`,
+    );
+  }
+}
+
+function isPathInside(root, candidate) {
+  const escaped = relative(root, candidate);
+  return escaped !== "" && !escaped.startsWith("..") && !isAbsolute(escaped);
+}
+
+function isExtractedBundleInside(tempDir, bundlePath) {
+  try {
+    const tempRoot = realpathSync(tempDir);
+    const bundleStat = lstatSync(bundlePath);
+    if (bundleStat.isSymbolicLink() || !bundleStat.isDirectory()) return false;
+    const bundleRoot = realpathSync(bundlePath);
+    if (!isPathInside(tempRoot, bundleRoot)) return false;
+
+    // The top-level bundle can be inside the temp directory while an inner
+    // symlink still points outside it. Walk without following directories and
+    // reject every such link before the bundle is moved into Applications.
+    const pending = [bundlePath];
+    while (pending.length > 0) {
+      const current = pending.pop();
+      if (current === undefined) continue;
+      const stat = lstatSync(current);
+      if (stat.isSymbolicLink()) {
+        if (!isPathInside(tempRoot, realpathSync(current))) return false;
+        continue;
+      }
+      if (!stat.isDirectory()) continue;
+      for (const entry of readdirSync(current)) {
+        pending.push(join(current, entry));
+      }
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 let spec;
 try {
   spec = resolvePayloadSpec(process.platform, process.arch);
@@ -99,11 +155,12 @@ if (existsSync(join(payloadRoot, "app"))) {
     try {
       rmSync(tmp, { recursive: true, force: true });
       mkdirSync(tmp, { recursive: true });
+      validateArchive(archivePath, bundleName);
       execFileSync("tar", ["-xzf", archivePath, "-C", tmp], { stdio: "inherit" });
       const tmpApp = join(tmp, bundleName);
-      if (!existsSync(tmpApp)) {
+      if (!existsSync(tmpApp) || !isExtractedBundleInside(tmp, tmpApp)) {
         rmSync(tmp, { recursive: true, force: true });
-        fail(`payload archive ${archivePath} did not contain ${bundleName}`);
+        fail(`payload archive ${archivePath} did not contain a safe ${bundleName}`);
       }
       mkdirSync(appsDir, { recursive: true });
       // Swap: move any existing install aside, rename the new one into place,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nissyai/desktop",
-  "version": "0.2.19",
+  "version": "0.2.25",
   "type": "module",
   "description": "Launcher for the Nissy desktop app. Resolves the host's app payload and spawns it. Run via `npx @nissyai/desktop`; a global install (`npm i -g @nissyai/desktop`) exposes the `nissy` command.",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,8 +20,8 @@
     "src/"
   ],
   "optionalDependencies": {
-    "@nissyai/app-win32-x64": "0.2.19",
-    "@nissyai/app-darwin-arm64": "0.2.19",
-    "@nissyai/app-darwin-x64": "0.2.19"
+    "@nissyai/app-win32-x64": "0.2.25",
+    "@nissyai/app-darwin-arm64": "0.2.25",
+    "@nissyai/app-darwin-x64": "0.2.25"
   }
 }

package/src/resolve.mjs

@@ -112,6 +112,37 @@ export function payloadCacheKey(pkg, version) {
   return `${safe}@${version}`;
 }
 
+/**
+ * Return archive entry names that must be rejected before extracting a macOS
+ * payload. The archive is produced by our build, but it is still untrusted at
+ * this boundary: npm package replacement or a compromised publish could turn
+ * a path traversal entry into a write outside the temporary install directory.
+ *
+ * Tar listings commonly prefix names with `./`, and the bundle itself contains
+ * legitimate framework symlinks, so this validates names only. The caller
+ * separately verifies the extracted top-level bundle is a real path inside the
+ * temporary directory before swapping it into ~/Applications.
+ *
+ * @param {readonly string[]} entries names from `tar -tzf`
+ * @param {string} bundleName expected top-level `.app` directory name
+ * @returns {string[]} original unsafe entry names
+ */
+export function unsafeArchiveEntries(entries, bundleName) {
+  const root = bundleName.replace(/\\/g, "/").replace(/^\.\/+|\/+$/g, "");
+  return entries.filter((entry) => {
+    const normalized = entry.replace(/\\/g, "/").replace(/^\.\/+/, "");
+    if (normalized === "") return false;
+    if (
+      normalized.startsWith("/") ||
+      /^[A-Za-z]:\//u.test(normalized) ||
+      normalized.split("/").includes("..")
+    ) {
+      return true;
+    }
+    return normalized !== root && !normalized.startsWith(`${root}/`);
+  });
+}
+
 /**
  * Given the entry names in the cache root and the current cache key, return the
  * stale extracted-payload dirs to prune (older versions of the SAME payload).