@pnpm/patching.apply-patch 1100.0.0 → 1100.0.2

package/README.md

@@ -3,7 +3,7 @@
 > Apply a patch to a directory
 
 <!--@shields('npm')-->
-[![npm version](https://img.shields.io/npm/v/@pnpm/patching.apply-patch.svg)](https://www.npmjs.com/package/@pnpm/patching.apply-patch)
+[![npm version](https://img.shields.io/npm/v/@pnpm/patching.apply-patch.svg)](https://npmx.dev/package/@pnpm/patching.apply-patch)
 <!--/@-->
 
 ## Installation

package/lib/index.d.ts

@@ -1,5 +1,9 @@
+import { PnpmError } from '@pnpm/error';
 export interface ApplyPatchToDirOpts {
     patchedDir: string;
     patchFilePath: string;
 }
 export declare function applyPatchToDir(opts: ApplyPatchToDirOpts): boolean;
+export declare class PatchPathEscapesError extends PnpmError {
+    constructor(opts: ApplyPatchToDirOpts, badPath: string);
+}

package/lib/index.js

@@ -1,8 +1,13 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import util from 'node:util';
 import { PnpmError } from '@pnpm/error';
 import { applyPatch } from '@pnpm/patch-package/dist/applyPatches.js';
+import { parsePatchFile } from '@pnpm/patch-package/dist/patch/parse.js';
 export function applyPatchToDir(opts) {
     // Ideally, we would just run "patch" or "git apply".
     // However, "patch" is not available on Windows and "git apply" is hard to execute on a subdirectory of an existing repository
+    assertPatchPathsStayInside(opts);
     const cwd = process.cwd();
     process.chdir(opts.patchedDir);
     let success = false;
@@ -11,11 +16,12 @@ export function applyPatchToDir(opts) {
             patchFilePath: opts.patchFilePath,
         });
     }
-    catch (err) { // eslint-disable-line
-        if (err.code === 'ENOENT') {
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
             throw new PnpmError('PATCH_NOT_FOUND', `Patch file not found: ${opts.patchFilePath}`);
         }
-        throw new PnpmError('INVALID_PATCH', `Applying patch "${opts.patchFilePath}" failed: ${err.message}`);
+        const message = util.types.isNativeError(err) ? err.message : String(err);
+        throw new PnpmError('INVALID_PATCH', `Applying patch "${opts.patchFilePath}" failed: ${message}`);
     }
     finally {
         process.chdir(cwd);
@@ -25,4 +31,53 @@ export function applyPatchToDir(opts) {
     }
     return success;
 }
+// A patch file is attacker-controlled data: `diff --git a/../../X b/../../X` headers
+// would otherwise let the applier traverse out of the package directory and write,
+// delete, or rename files anywhere the install user can.
+function assertPatchPathsStayInside(opts) {
+    let patchContent;
+    try {
+        patchContent = fs.readFileSync(opts.patchFilePath, 'utf8');
+    }
+    catch (err) {
+        if (util.types.isNativeError(err) && 'code' in err && err.code === 'ENOENT') {
+            throw new PnpmError('PATCH_NOT_FOUND', `Patch file not found: ${opts.patchFilePath}`);
+        }
+        throw err;
+    }
+    let effects;
+    try {
+        effects = parsePatchFile(patchContent);
+    }
+    catch {
+        // Defer parse-error reporting to applyPatch so its existing
+        // ERR_PNPM_INVALID_PATCH path produces the message and exit behavior.
+        return;
+    }
+    const root = path.resolve(opts.patchedDir);
+    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+    for (const effect of effects) {
+        const candidates = effect.type === 'rename'
+            ? [effect.fromPath, effect.toPath]
+            : [effect.path];
+        for (const candidate of candidates) {
+            if (!candidate)
+                continue;
+            if (path.isAbsolute(candidate) ||
+                candidate.split(/[/\\]/).includes('..')) {
+                throw new PatchPathEscapesError(opts, candidate);
+            }
+            const resolved = path.resolve(root, candidate);
+            if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+                throw new PatchPathEscapesError(opts, candidate);
+            }
+        }
+    }
+}
+export class PatchPathEscapesError extends PnpmError {
+    constructor(opts, badPath) {
+        super('PATCH_FAILED', `Could not apply patch ${opts.patchFilePath} to ${opts.patchedDir}: ` +
+            `patch path escapes target dir: ${badPath}`);
+    }
+}
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/patching.apply-patch",
-  "version": "1100.0.0",
+  "version": "1100.0.2",
   "description": "Apply a patch to a directory",
   "keywords": [
     "pnpm",
@@ -9,7 +9,10 @@
   ],
   "license": "MIT",
   "funding": "https://opencollective.com/pnpm",
-  "repository": "https://github.com/pnpm/pnpm/tree/main/patching/apply-patch",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/patching/apply-patch"
+  },
   "homepage": "https://github.com/pnpm/pnpm/tree/main/patching/apply-patch#readme",
   "bugs": {
     "url": "https://github.com/pnpm/pnpm/issues"
@@ -29,14 +32,14 @@
     "@pnpm/error": "1100.0.0"
   },
   "peerDependencies": {
-    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+    "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
-    "@jest/globals": "30.3.0",
+    "@jest/globals": "30.4.1",
+    "@pnpm/prepare": "1100.0.16",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/patching.apply-patch": "1100.0.0",
-    "@pnpm/prepare": "1100.0.0",
-    "@pnpm/test-fixtures": "1100.0.0"
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/patching.apply-patch": "1100.0.2"
   },
   "engines": {
     "node": ">=22.13"