@vercel/build-utils 6.2.1 → 6.2.2

package/dist/fs/glob.js

@@ -32,13 +32,24 @@ async function glob(pattern, opts, mountpoint) {
     const dirs = new Set();
     const dirsWithEntries = new Set();
     for (const relativePath of files) {
-        const fsPath = normalize_path_1.normalizePath(path_1.default.join(options.cwd, relativePath));
+        const absPath = path_1.default.join(options.cwd, relativePath);
+        const fsPath = normalize_path_1.normalizePath(absPath);
         let stat = statCache[fsPath];
         assert_1.default(stat, `statCache does not contain value for ${relativePath} (resolved to ${fsPath})`);
         const isSymlink = symlinks[fsPath];
+        // When `follow` mode is enabled, ensure that the entry is not a symlink
+        // that points to outside of `cwd`
+        if (options.follow &&
+            (isSymlink || (await fs_extra_1.lstat(fsPath)).isSymbolicLink())) {
+            const target = await fs_extra_1.readlink(absPath);
+            const absTarget = path_1.default.resolve(path_1.default.dirname(absPath), target);
+            if (path_1.default.relative(options.cwd, absTarget).startsWith(`..${path_1.default.sep}`)) {
+                continue;
+            }
+        }
         if (isSymlink || stat.isFile() || stat.isDirectory()) {
             if (isSymlink) {
-                stat = await fs_extra_1.lstat(fsPath);
+                stat = await fs_extra_1.lstat(absPath);
             }
             // Some bookkeeping to track which directories already have entries within
             const dirname = path_1.default.dirname(relativePath);

package/dist/index.js

@@ -30744,13 +30744,24 @@ async function glob(pattern, opts, mountpoint) {
     const dirs = new Set();
     const dirsWithEntries = new Set();
     for (const relativePath of files) {
-        const fsPath = normalize_path_1.normalizePath(path_1.default.join(options.cwd, relativePath));
+        const absPath = path_1.default.join(options.cwd, relativePath);
+        const fsPath = normalize_path_1.normalizePath(absPath);
         let stat = statCache[fsPath];
         assert_1.default(stat, `statCache does not contain value for ${relativePath} (resolved to ${fsPath})`);
         const isSymlink = symlinks[fsPath];
+        // When `follow` mode is enabled, ensure that the entry is not a symlink
+        // that points to outside of `cwd`
+        if (options.follow &&
+            (isSymlink || (await fs_extra_1.lstat(fsPath)).isSymbolicLink())) {
+            const target = await fs_extra_1.readlink(absPath);
+            const absTarget = path_1.default.resolve(path_1.default.dirname(absPath), target);
+            if (path_1.default.relative(options.cwd, absTarget).startsWith(`..${path_1.default.sep}`)) {
+                continue;
+            }
+        }
         if (isSymlink || stat.isFile() || stat.isDirectory()) {
             if (isSymlink) {
-                stat = await fs_extra_1.lstat(fsPath);
+                stat = await fs_extra_1.lstat(absPath);
             }
             // Some bookkeeping to track which directories already have entries within
             const dirname = path_1.default.dirname(relativePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/build-utils",
-  "version": "6.2.1",
+  "version": "6.2.2",
   "license": "MIT",
   "main": "./dist/index.js",
   "types": "./dist/index.d.js",
@@ -51,5 +51,5 @@
     "typescript": "4.3.4",
     "yazl": "2.5.1"
   },
-  "gitHead": "c1c8b454cc29de4bd306b87078f36d6416ceb90f"
+  "gitHead": "95a4dcfb33d813f1a0ef18d766232d42c876ce69"
 }