@tinycloud/cli 1.3.6-beta.1 → 1.3.6

package/dist/courier-entry.js

@@ -901,12 +901,24 @@ import fs from "fs";
 import path from "path";
 import { randomBytes } from "crypto";
 function profileDir() {
-  if (process.env.COURIER_HOME)
-    return process.env.COURIER_HOME;
-  const home = process.env.HOME;
-  if (!home)
-    throw new CourierError("home-unset", "HOME is not set. Set HOME or COURIER_HOME to choose where Courier stores its state.");
-  return path.join(home, ".courier");
+  let dir = process.env.COURIER_HOME;
+  if (!dir) {
+    const home = process.env.HOME;
+    if (!home)
+      throw new CourierError("home-unset", "HOME is not set. Set HOME or COURIER_HOME to choose where Courier stores its state.");
+    dir = path.join(home, ".courier");
+  }
+  assertTestHome(dir);
+  return dir;
+}
+function assertTestHome(dir) {
+  if (process.env.COURIER_TEST !== "1")
+    return;
+  const root = process.env.COURIER_TEST_HOME ? path.resolve(process.env.COURIER_TEST_HOME) : void 0;
+  const resolved = path.resolve(dir);
+  if (!root || resolved !== root && !resolved.startsWith(root + path.sep)) {
+    throw new CourierError("test-home-escape", `COURIER_TEST=1: ${resolved} is outside COURIER_TEST_HOME (${root ?? "unset"}).`);
+  }
 }
 function profilePath(name2, home = profileDir()) {
   return path.join(home, name2);