@uipath/audit-commands 1.202.0-preview.134 → 1.202.0-preview.136

package/dist/index.js

@@ -2225,6 +2225,7 @@ var require_errors = __commonJS(function(exports) {
     DESCRIPTOR_FAULTY: "Descriptor data is malformed",
     NO_DATA: "Nothing to decompress",
     BAD_CRC: "CRC32 checksum failed {0}",
+    MAX_OUTPUT_EXCEEDED: "Decompressed data exceeds the declared uncompressed size",
     FILE_IN_THE_WAY: "There is a file in the way: {0}",
     UNKNOWN_METHOD: "Invalid/unsupported compression method",
     AVAIL_DATA: "inflate::Available inflate data did not terminate",
@@ -2242,11 +2243,13 @@ var require_errors = __commonJS(function(exports) {
     DISK_ENTRY_TOO_LARGE: "Number of disk entries is too large",
     NO_ZIP: "No zip file was loaded",
     NO_ENTRY: "Entry doesn't exist",
+    DUPLICATE_ENTRY: "Duplicate entry name {0}",
     DIRECTORY_CONTENT_ERROR: "A directory cannot have content",
     FILE_NOT_FOUND: 'File not found: "{0}"',
     NOT_IMPLEMENTED: "Not implemented",
     INVALID_FILENAME: "Invalid filename",
     INVALID_FORMAT: "Invalid or unsupported zip format. No END header found",
+    ZIP64_VALUE_TOO_LARGE: "Zip64 value exceeds the maximum safe integer",
     INVALID_PASS_PARAM: "Incompatible password parameter",
     WRONG_PASSWORD: "Wrong Password",
     COMMENT_TOO_LONG: "Comment is too long",
@@ -2400,8 +2403,49 @@ var require_utils = __commonJS(function(exports, module) {
       });
     });
   };
+  Utils.prototype.assertPathSafe = function(root, target) {
+    const self = this;
+    if (typeof self.fs.lstatSync !== "function")
+      return;
+    const resolvedRoot = pth.resolve(root);
+    const resolvedTarget = pth.resolve(target);
+    if (resolvedTarget === resolvedRoot)
+      return;
+    const rel = pth.relative(resolvedRoot, resolvedTarget);
+    if (!rel || rel === ".." || rel.startsWith(".." + pth.sep) || pth.isAbsolute(rel))
+      return;
+    let cur = resolvedRoot;
+    for (const part of rel.split(pth.sep)) {
+      if (!part || part === ".")
+        continue;
+      cur = pth.join(cur, part);
+      let stat2;
+      try {
+        stat2 = self.fs.lstatSync(cur);
+      } catch (e) {
+        break;
+      }
+      if (stat2.isSymbolicLink())
+        throw Errors.FILE_IN_THE_WAY(`"${cur}"`);
+    }
+  };
   Utils.prototype.findFiles = function(path2) {
     const self = this;
+    const canLstat = typeof self.fs.lstatSync === "function";
+    const rootReal = self.fs.realpathSync(path2);
+    function escapesRoot(p) {
+      if (!canLstat)
+        return false;
+      if (!self.fs.lstatSync(p).isSymbolicLink())
+        return false;
+      let real;
+      try {
+        real = self.fs.realpathSync(p);
+      } catch (e) {
+        return true;
+      }
+      return !(real === rootReal || real.startsWith(rootReal + pth.sep));
+    }
     function findSync(dir, pattern, recursive, visited) {
       if (typeof pattern === "boolean") {
         recursive = pattern;
@@ -2410,6 +2454,8 @@ var require_utils = __commonJS(function(exports, module) {
       let files = [];
       self.fs.readdirSync(dir).forEach(function(file) {
         const path3 = pth.join(dir, file);
+        if (escapesRoot(path3))
+          return;
         const stat2 = self.fs.statSync(path3);
         if (!pattern || pattern.test(path3)) {
           files.push(pth.normalize(path3) + (stat2.isDirectory() ? self.sep : ""));
@@ -2424,7 +2470,7 @@ var require_utils = __commonJS(function(exports, module) {
       });
       return files;
     }
-    return findSync(path2, undefined, true, new Set([self.fs.realpathSync(path2)]));
+    return findSync(path2, undefined, true, new Set([rootReal]));
   };
   Utils.prototype.findFilesAsync = function(dir, cb) {
     const self = this;
@@ -2436,6 +2482,23 @@ var require_utils = __commonJS(function(exports, module) {
       finished = true;
       cb(err, err ? undefined : results);
     };
+    const canLstat = typeof self.fs.lstat === "function";
+    let rootReal = null;
+    const escapesRoot = function(file, cb2) {
+      if (!canLstat)
+        return cb2(null, false);
+      self.fs.lstat(file, function(err, lst) {
+        if (err)
+          return cb2(err);
+        if (!lst || !lst.isSymbolicLink())
+          return cb2(null, false);
+        self.fs.realpath(file, function(err2, real) {
+          if (err2)
+            return cb2(null, true);
+          cb2(null, !(real === rootReal || real.startsWith(rootReal + pth.sep)));
+        });
+      });
+    };
     const walk = function(dir2, visited, done) {
       self.fs.readdir(dir2, function(err, list) {
         if (err)
@@ -2445,34 +2508,43 @@ var require_utils = __commonJS(function(exports, module) {
           return done();
         list.forEach(function(name) {
           const file = pth.join(dir2, name);
-          self.fs.stat(file, function(err2, stat2) {
+          escapesRoot(file, function(err2, escapes) {
             if (err2)
               return done(err2);
-            if (!stat2) {
+            if (escapes) {
               if (!--pending)
                 done();
               return;
             }
-            results.push(pth.normalize(file) + (stat2.isDirectory() ? self.sep : ""));
-            if (!stat2.isDirectory()) {
-              if (!--pending)
-                done();
-              return;
-            }
-            self.fs.realpath(file, function(err3, realDir) {
+            self.fs.stat(file, function(err3, stat2) {
               if (err3)
                 return done(err3);
-              if (visited.has(realDir)) {
+              if (!stat2) {
                 if (!--pending)
                   done();
                 return;
               }
-              visited.add(realDir);
-              walk(file, visited, function(err4) {
-                if (err4)
-                  return done(err4);
+              results.push(pth.normalize(file) + (stat2.isDirectory() ? self.sep : ""));
+              if (!stat2.isDirectory()) {
                 if (!--pending)
                   done();
+                return;
+              }
+              self.fs.realpath(file, function(err4, realDir) {
+                if (err4)
+                  return done(err4);
+                if (visited.has(realDir)) {
+                  if (!--pending)
+                    done();
+                  return;
+                }
+                visited.add(realDir);
+                walk(file, visited, function(err5) {
+                  if (err5)
+                    return done(err5);
+                  if (!--pending)
+                    done();
+                });
               });
             });
           });
@@ -2482,6 +2554,7 @@ var require_utils = __commonJS(function(exports, module) {
     self.fs.realpath(dir, function(err, realDir) {
       if (err)
         return finish(err);
+      rootReal = realDir;
       walk(dir, new Set([realDir]), finish);
     });
   };
@@ -2556,7 +2629,11 @@ var require_utils = __commonJS(function(exports, module) {
   Utils.readBigUInt64LE = function(buffer, index) {
     const lo = buffer.readUInt32LE(index);
     const hi = buffer.readUInt32LE(index + 4);
-    return hi * 4294967296 + lo;
+    const value = hi * 4294967296 + lo;
+    if (value > Number.MAX_SAFE_INTEGER) {
+      throw Errors.ZIP64_VALUE_TOO_LARGE();
+    }
+    return value;
   };
   Utils.writeBigUInt64LE = function(buffer, value, index) {
     const lo = value >>> 0;
@@ -2808,7 +2885,7 @@ var require_entryHeader = __commonJS(function(exports, module) {
         _attr = uint32(val);
       },
       get fileAttr() {
-        return (_attr || 0) >> 16 & 4095;
+        return (_attr || 0) >> 16 & 511;
       },
       get offset() {
         return _offset;
@@ -2829,6 +2906,9 @@ var require_entryHeader = __commonJS(function(exports, module) {
         return _localHeader;
       },
       loadLocalHeaderFromBinary: function(input) {
+        if (_offset < 0 || _offset + Constants.LOCHDR > input.length) {
+          throw Utils.Errors.INVALID_LOC();
+        }
         var data = input.slice(_offset, _offset + Constants.LOCHDR);
         if (data.readUInt32LE(0) !== Constants.LOCSIG) {
           throw Utils.Errors.INVALID_LOC();
@@ -3094,20 +3174,40 @@ var require_deflater = __commonJS(function(exports, module) {
 // ../../../node_modules/adm-zip/methods/inflater.js
 var require_inflater = __commonJS(function(exports, module) {
   var version = +(process?.versions?.node ?? "").split(".")[0] || 0;
+  var Errors = require_errors();
   module.exports = function(inbuf, expectedLength) {
     var zlib = __require("zlib");
-    const option = version >= 15 && expectedLength > 0 ? { maxOutputLength: expectedLength } : {};
+    const maxOutputLength = expectedLength > 0 ? expectedLength : 1;
+    const option = version >= 15 ? { maxOutputLength } : {};
     return {
       inflate: function() {
         return zlib.inflateRawSync(inbuf, option);
       },
       inflateAsync: function(callback) {
-        var tmp = zlib.createInflateRaw(option), parts = [], total = 0;
+        var tmp = zlib.createInflateRaw(option), parts = [], total = 0, done = false;
+        const fail = function(err) {
+          if (done)
+            return;
+          done = true;
+          tmp.destroy();
+          callback && callback(Buffer.alloc(0), err);
+        };
+        tmp.on("error", function(err) {
+          fail(err);
+        });
         tmp.on("data", function(data) {
-          parts.push(data);
+          if (done)
+            return;
           total += data.length;
+          if (total > maxOutputLength) {
+            return fail(Errors.MAX_OUTPUT_EXCEEDED());
+          }
+          parts.push(data);
         });
         tmp.on("end", function() {
+          if (done)
+            return;
+          done = true;
           var buf = Buffer.alloc(total), written = 0;
           buf.fill(0);
           for (var i = 0;i < parts.length; i++) {
@@ -3264,7 +3364,12 @@ var require_zipEntry = __commonJS(function(exports, module) {
         return Buffer.alloc(0);
       }
       _extralocal = _centralHeader.loadLocalHeaderFromBinary(input);
-      return input.slice(_centralHeader.realDataOffset, _centralHeader.realDataOffset + _centralHeader.compressedSize);
+      const dataOffset = _centralHeader.realDataOffset;
+      const dataEnd = dataOffset + _centralHeader.compressedSize;
+      if (dataOffset < 0 || dataEnd < dataOffset || dataEnd > input.length) {
+        throw Utils.Errors.INVALID_LOC();
+      }
+      return input.slice(dataOffset, dataEnd);
     }
     function crc32OK(data) {
       const expectedCrc = _centralHeader.flags_desc || _centralHeader.localHeader.flags_desc ? _centralHeader.crc : _centralHeader.localHeader.crc;
@@ -3281,17 +3386,26 @@ var require_zipEntry = __commonJS(function(exports, module) {
         }
         return Buffer.alloc(0);
       }
-      var compressedData = getCompressedDataFromZip();
-      if (compressedData.length === 0) {
-        if (async && callback)
-          callback(compressedData);
-        return compressedData;
-      }
-      if (_centralHeader.encrypted) {
-        if (typeof pass !== "string" && !Buffer.isBuffer(pass)) {
-          throw Utils.Errors.INVALID_PASS_PARAM();
+      var compressedData;
+      try {
+        compressedData = getCompressedDataFromZip();
+        if (compressedData.length === 0) {
+          if (async && callback)
+            callback(compressedData);
+          return compressedData;
         }
-        compressedData = Methods.ZipCrypto.decrypt(compressedData, _centralHeader, pass);
+        if (_centralHeader.encrypted) {
+          if (typeof pass !== "string" && !Buffer.isBuffer(pass)) {
+            throw Utils.Errors.INVALID_PASS_PARAM();
+          }
+          compressedData = Methods.ZipCrypto.decrypt(compressedData, _centralHeader, pass);
+        }
+      } catch (err) {
+        if (async && callback) {
+          callback(Buffer.alloc(0), err);
+          return Buffer.alloc(0);
+        }
+        throw err;
       }
       var data;
       switch (_centralHeader.method) {
@@ -3316,13 +3430,15 @@ var require_zipEntry = __commonJS(function(exports, module) {
             }
             return data;
           } else {
-            inflater.inflateAsync(function(result) {
-              if (callback) {
-                if (!crc32OK(result)) {
-                  callback(result, Utils.Errors.BAD_CRC());
-                } else {
-                  callback(result);
-                }
+            inflater.inflateAsync(function(result, err) {
+              if (!callback)
+                return;
+              if (err) {
+                callback(Buffer.alloc(0), err);
+              } else if (!crc32OK(result)) {
+                callback(result, Utils.Errors.BAD_CRC());
+              } else {
+                callback(result);
               }
             });
           }
@@ -3614,6 +3730,9 @@ var require_zipFile = __commonJS(function(exports, module) {
         if (entry.header.commentLength)
           entry.comment = inBuffer.slice(tmp, tmp + entry.header.commentLength);
         index += entry.header.centralHeaderSize;
+        if (entry.entryName in entryTable) {
+          throw Utils.Errors.DUPLICATE_ENTRY(`"${entry.entryName}"`);
+        }
         entryList[i] = entry;
         entryTable[entry.entryName] = entry;
       }
@@ -4139,7 +4258,7 @@ var require_adm_zip = __commonJS(function(exports, module) {
       addLocalFolderAsync2: function(options2, callback) {
         const self = this;
         options2 = typeof options2 === "object" ? options2 : { localPath: options2 };
-        const localPath = pth.resolve(fixPath(options2.localPath));
+        const localPath = pth.resolve(options2.localPath);
         let { zipPath, filter, namefix } = options2;
         if (filter instanceof RegExp) {
           filter = function(rx) {
@@ -4162,16 +4281,16 @@ var require_adm_zip = __commonJS(function(exports, module) {
         const fileNameFix = (entry) => pth.win32.basename(pth.win32.normalize(namefix(entry)));
         filetools.fs.open(localPath, "r", function(err) {
           if (err && err.code === "ENOENT") {
-            callback(undefined, Utils.Errors.FILE_NOT_FOUND(localPath));
+            callback(Utils.Errors.FILE_NOT_FOUND(localPath), false);
           } else if (err) {
-            callback(undefined, err);
+            callback(err, false);
           } else {
             filetools.findFilesAsync(localPath, function(err2, fileEntries) {
               if (err2)
-                return callback(err2);
+                return callback(err2, false);
               fileEntries = fileEntries.filter((dir) => filter(relPathFix(dir)));
               if (!fileEntries.length)
-                callback(undefined, false);
+                return callback(undefined, true);
               setImmediate(fileEntries.reverse().reduce(function(next, entry) {
                 return function(err3, done) {
                   if (err3 || done === false)
@@ -4191,7 +4310,7 @@ var require_adm_zip = __commonJS(function(exports, module) {
         return new Promise((resolve2, reject) => {
           this.addLocalFolderAsync2(Object.assign({ localPath }, props), (err, done) => {
             if (err)
-              reject(err);
+              return reject(err);
             if (done)
               resolve2(this);
           });
@@ -4261,6 +4380,7 @@ var require_adm_zip = __commonJS(function(exports, module) {
             }
             var name = canonical(maintainEntryPath ? child.entryName : child.entryName.substring(item.entryName.length));
             var childName = sanitize(targetPath, name);
+            filetools.assertPathSafe(targetPath, childName);
             const fileAttr2 = keepOriginalPermission ? child.header.fileAttr : undefined;
             filetools.writeFileTo(childName, content2, overwrite, fileAttr2);
           });
@@ -4269,6 +4389,7 @@ var require_adm_zip = __commonJS(function(exports, module) {
         var content = item.getData(_zip.password);
         if (!content)
           throw Utils.Errors.CANT_EXTRACT_FILE();
+        filetools.assertPathSafe(targetPath, target);
         if (filetools.fs.existsSync(target) && !overwrite) {
           throw Utils.Errors.CANT_OVERRIDE();
         }
@@ -4304,6 +4425,7 @@ var require_adm_zip = __commonJS(function(exports, module) {
         const dirEntries = [];
         _zip.entries.forEach(function(entry) {
           var entryName = sanitize(targetPath, canonical(entry.entryName));
+          filetools.assertPathSafe(targetPath, entryName);
           if (entry.isDirectory) {
             filetools.makeDir(entryName);
             if (keepOriginalPermission)
@@ -4358,6 +4480,7 @@ var require_adm_zip = __commonJS(function(exports, module) {
           const dirPath = getPath(entry);
           const dirAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;
           try {
+            filetools.assertPathSafe(targetPath, dirPath);
             filetools.makeDir(dirPath);
           } catch (er) {
             callback(getError("Unable to create folder", dirPath));
@@ -4386,6 +4509,11 @@ var require_adm_zip = __commonJS(function(exports, module) {
             } else {
               const entryName = pth.normalize(canonical(entry.entryName));
               const filePath = sanitize(targetPath, entryName);
+              try {
+                filetools.assertPathSafe(targetPath, filePath);
+              } catch (er) {
+                return next(er);
+              }
               entry.getDataAsync(function(content, err_1) {
                 if (err_1) {
                   next(err_1);
@@ -7789,7 +7917,7 @@ var jmespathSlot = singleton("JmespathCodec");
 async function loadOutputCodecsAsync(needed) {
   const loads = [];
   if (needed.yaml && yamlSlot.get() === undefined) {
-    loads.push(import("./js-yaml-ac3y4ax7.js").then((mod) => {
+    loads.push(import("./js-yaml-71wj4em9.js").then((mod) => {
       yamlSlot.set(mod);
     }));
   }
@@ -10615,4 +10743,4 @@ export {
   registerCommands
 };
 
-//# debugId=22A07077BBF1F28C64756E2164756E21
+//# debugId=A233A76C0C48589C64756E2164756E21

package/dist/{js-yaml-ac3y4ax7.js → js-yaml-71wj4em9.js}

@@ -1334,16 +1334,21 @@ function requireLoader() {
       state.result += _result;
     }
   }
+  function chargeMergeWork(state) {
+    state.totalMergeKeys++;
+    if (state.maxTotalMergeKeys !== -1 && state.totalMergeKeys > state.maxTotalMergeKeys) {
+      throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
+    }
+  }
   function mergeMappings(state, destination, source, overridableKeys) {
     if (!common2.isObject(source)) {
       throwError(state, "cannot merge mappings; the provided source object is unacceptable");
     }
+    chargeMergeWork(state);
     const sourceKeys = Object.keys(source);
     for (let index = 0, quantity = sourceKeys.length;index < quantity; index += 1) {
       const key = sourceKeys[index];
-      if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
-        throwError(state, "merge keys exceeded maxTotalMergeKeys (" + state.maxTotalMergeKeys + ")");
-      }
+      chargeMergeWork(state);
       if (!_hasOwnProperty.call(destination, key)) {
         setProperty(destination, key, source[key]);
         overridableKeys[key] = true;
@@ -1371,6 +1376,9 @@ function requireLoader() {
     }
     if (keyTag === "tag:yaml.org,2002:merge") {
       if (Array.isArray(valueNode)) {
+        if (valueNode.length > 100) {
+          throwError(state, "abnormal merge sequence size");
+        }
         for (let index = 0, quantity = valueNode.length;index < quantity; index += 1) {
           mergeMappings(state, _result, valueNode[index], overridableKeys);
         }
@@ -3142,4 +3150,4 @@ export {
   types
 };
 
-//# debugId=013F44E69BAB139B64756E2164756E21
+//# debugId=87463FE309AE7C9C64756E2164756E21

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@uipath/audit-commands",
     "license": "MIT",
-    "version": "1.202.0-preview.134",
+    "version": "1.202.0-preview.136",
     "description": "Admin CLI commands for the UiPath Audit Service — query event sources, paginate events, and export ZIPs from the long-term store. Library composed by admin-tool, not a standalone CLI tool.",
     "private": false,
     "repository": {
@@ -25,14 +25,5 @@
     "files": [
         "dist"
     ],
-    "devDependencies": {
-        "@types/bun": "^1.3.11",
-        "@uipath/audit-sdk": "1.202.0",
-        "@uipath/common": "1.202.0",
-        "@uipath/filesystem": "1.202.0",
-        "adm-zip": "^0.6.0",
-        "commander": "^14.0.3",
-        "typescript": "^7.0.2"
-    },
-    "gitHead": "a335728adbdb02f28308e4f55d8936d0b150444b"
+    "gitHead": "f6270de2c7c04f4c43b2f5187b0c3d3c314c2610"
 }