@pnpm/deps.graph-builder 1100.0.19 → 1100.0.20

package/lib/lockfileToDepGraph.js

@@ -4,6 +4,7 @@ import { packageIsInstallable } from '@pnpm/config.package-is-installable';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { progressLogger, } from '@pnpm/core-loggers';
 import * as dp from '@pnpm/deps.path';
+import { safeJoinModulesDir } from '@pnpm/fs.symlink-dependency';
 import { packageIdFromSnapshot, pkgSnapshotToResolution, } from '@pnpm/lockfile.utils';
 import { logger } from '@pnpm/logger';
 import { getPatchInfo } from '@pnpm/patching.config';
@@ -102,7 +103,11 @@ async function buildGraphFromPackages(lockfile, currentLockfile, opts) {
                 equals(currentPackages[depPath].dependencies, pkgSnapshot.dependencies);
             const depIntegrityIsUnchanged = isIntegrityEqual(pkgSnapshot.resolution, currentPackages[depPath]?.resolution);
             const modules = path.join(dirInVirtualStore, 'node_modules');
-            const dir = path.join(modules, pkgName);
+            // `pkgName` is reconstructed from the (attacker-controllable) lockfile
+            // depPath key via `dp.parse`, which does no validation. Contain it here so
+            // a traversal name (e.g. `../../../tmp/x`) can't make the package import
+            // escape the virtual store. Mirrors the guard on the hoisted linker.
+            const dir = safeJoinModulesDir(modules, pkgName);
             locationByDepPath[depPath] = dir;
             // Track directory deps for injected workspace packages
             if (isDirectoryDep) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.graph-builder",
-  "version": "1100.0.19",
+  "version": "1100.0.20",
   "description": "A package for building a dependency graph from a lockfile",
   "keywords": [
     "pnpm",
@@ -31,24 +31,26 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "@pnpm/config.package-is-installable": "1100.0.12",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.7",
+    "@pnpm/core-loggers": "1100.2.1",
+    "@pnpm/deps.graph-hasher": "1100.2.8",
     "@pnpm/deps.path": "1100.0.8",
-    "@pnpm/lockfile.fs": "1100.1.8",
+    "@pnpm/fs.symlink-dependency": "1100.0.10",
     "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/lockfile.fs": "1100.1.9",
     "@pnpm/installing.modules-yaml": "1100.0.9",
     "@pnpm/patching.types": "1100.0.0",
-    "@pnpm/store.controller-types": "1100.1.7",
+    "@pnpm/patching.config": "1100.0.9",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/core-loggers": "1100.2.1",
     "@pnpm/hooks.types": "1100.1.1",
-    "@pnpm/patching.config": "1100.0.9"
+    "@pnpm/store.controller-types": "1100.1.7"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
+    "@jest/globals": "30.4.1",
     "@types/ramda": "0.31.1",
-    "@pnpm/deps.graph-builder": "1100.0.19",
+    "@pnpm/deps.graph-builder": "1100.0.20",
     "@pnpm/logger": "1100.0.0"
   },
   "engines": {
@@ -58,8 +60,9 @@
     "preset": "@pnpm/jest-config"
   },
   "scripts": {
-    "lint": "eslint \"src/**/*.ts\"",
-    "test": "pn compile",
-    "compile": "tsgo --build && pn lint --fix"
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
   }
 }