@vltpkg/graph 1.0.1 → 1.0.2

package/dist/actual/load.js

@@ -292,7 +292,10 @@ export const load = (options) => {
         }
         catch {
             // Hidden lockfile is cache-only, safe to regenerate on any error
-            // as it will fall back to filesystem traversal
+            // as it will fall back to filesystem traversal. Deliberately also
+            // swallows EINVALIDNAME, unlike ideal/build.ts: this cache lives
+            // inside node_modules and regenerating it is the right response,
+            // whereas failing loud would let it brick installs.
             // TODO: Warn version mismatch to @vltpkg/output for debugging
         }
     }

package/dist/graph.js

@@ -1,7 +1,7 @@
 import { getId, joinDepIDTuple, splitExtra } from '@vltpkg/dep-id';
 import { error } from '@vltpkg/error-cause';
 import { satisfies } from '@vltpkg/satisfies';
-import { getOptions, Spec } from '@vltpkg/spec';
+import { assertPathSafeName, getOptions, Spec } from '@vltpkg/spec';
 import { inspect } from 'node:util';
 import { lockfileData } from "./lockfile/save.js";
 import { Edge } from "./edge.js";
@@ -214,6 +214,8 @@ export class Graph {
             if (to) {
                 spec.name = to.name /* c8 ignore next */ || '(unknown)';
                 spec.spec = `${to.name}@${spec.bareSpec}`;
+                // this alias becomes the symlink segment in add-edge
+                assertPathSafeName(spec.name, spec.spec);
             }
             else {
                 throw error('Impossible to place a missing, nameless dependency', { spec });

package/dist/ideal/append-nodes.js

@@ -6,6 +6,7 @@ import { longDependencyTypes, normalizeManifest } from '@vltpkg/types';
 import { fixupAddedNames } from "../fixup-added-names.js";
 import { shorten } from "../dependencies.js";
 import { removeOptionalSubgraph } from "../remove-optional-subgraph.js";
+import { isPathSecurityError } from "../path-security-error.js";
 import { extractNode } from "../reify/extract-node.js";
 import { checkPeerEdgesCompatible, endPeerPlacement, forkPeerContext, postPlacementPeerCheck, startPeerPlacement, } from "./peers.js";
 import { compareByHasPeerDeps } from "./sorting.js";
@@ -203,7 +204,10 @@ const fetchManifestsForDeps = async (packageInfo, graph, fromNode, deps, scurry,
                 .manifest(spec, { from: scurry.resolve(fromNode.location) })
                 .then(manifest => manifest)
                 .catch((er) => {
-                // optional deps ignored if inaccessible
+                // optional deps ignored if inaccessible, but a dep that tried
+                // to escape the project is never silently dropped
+                if (isPathSecurityError(er))
+                    throw er;
                 if (edgeOptional || fromNode.optional) {
                     return undefined;
                 }
@@ -294,7 +298,9 @@ const processPlacementTasks = async (graph, options, placementTasks, add, modifi
         const peerSetHash = peerPlacement.peerSetHash;
         const queuedEntries = peerPlacement.queuedEntries;
         // places a new node in the graph representing a newly seen dependency
-        const node = graph.placePackage(fromNode, type, spec, normalizeManifest(manifest), fileTypeInfo?.id, joinExtra({ peerSetHash, modifier: queryModifier }));
+        const node = graph.placePackage(fromNode, type, spec, 
+        // report broken manifest names against the dependency spec
+        normalizeManifest(manifest, String(spec)), fileTypeInfo?.id, joinExtra({ peerSetHash, modifier: queryModifier }));
         /* c8 ignore start - not possible, already ensured manifest */
         if (!node) {
             throw error('failed to place package', {

package/dist/ideal/build.js

@@ -3,6 +3,7 @@ import { graphStep } from '@vltpkg/output';
 import { load as loadActual } from "../actual/load.js";
 import { load as loadVirtual } from "../lockfile/load.js";
 import { buildIdealFromStartingGraph } from "./build-ideal-from-starting-graph.js";
+import { isPathSecurityError } from "../path-security-error.js";
 import { splitDepID } from '@vltpkg/dep-id';
 const getMap = (m) => m ?? new Map();
 /**
@@ -40,6 +41,9 @@ export const build = async (options) => {
         });
     }
     catch (err) {
+        // a path-safety verdict must not be silently rebuilt away
+        if (isPathSecurityError(err))
+            throw err;
         // Check if this is a lockfile version mismatch
         const cause = err.cause;
         if (cause?.code === 'ELOCKFILEVERSION') {

package/dist/lockfile/load-nodes.js

@@ -1,5 +1,5 @@
 import { error } from '@vltpkg/error-cause';
-import { splitDepID, splitExtra } from '@vltpkg/dep-id/browser';
+import { asDepID, splitDepID, splitExtra, } from '@vltpkg/dep-id/browser';
 import { getBooleanFlagsFromNum, getBuildStateFromNum, } from "./types.js";
 export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest) => {
     const entries = Object.entries(nodes);
@@ -8,6 +8,9 @@ export const loadNodes = (graph, nodes, options, actual, throwOnMissingManifest)
     // Only used for non-trivial graphs
     const registryVersionCache = nodeCount > 50 ? new Map() : null;
     for (const [id, lockfileNode] of entries) {
+        // lockfile keys have never been through `encode`, so they can hold
+        // anything, and the id is the store directory name
+        asDepID(id);
         const [flags, name, integrity, resolved, location, manifest, rawManifest, platform, bins, buildState,] = lockfileNode;
         // workspace nodes and the project root node are already part of the
         // graph and it should not create new nodes if an existing one is there

package/dist/path-security-error.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Is this error a path-safety verdict? Walks the cause chain, because
+ * lower layers (eg `PackageJson.read`) re-wrap what they throw.
+ */
+export declare const isPathSecurityError: (er: unknown) => boolean;

package/dist/path-security-error.js

@@ -0,0 +1,13 @@
+const codes = new Set(['EINVALIDNAME']);
+/**
+ * Is this error a path-safety verdict? Walks the cause chain, because
+ * lower layers (eg `PackageJson.read`) re-wrap what they throw.
+ */
+export const isPathSecurityError = (er) => {
+    for (let e = er; e && typeof e === 'object'; e = e.cause) {
+        const { code } = e;
+        if (typeof code === 'string' && codes.has(code))
+            return true;
+    }
+    return false;
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/graph",
   "description": "A library that helps understanding & expressing what happens on an install",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,26 +13,26 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/cmd-shim": "1.0.1",
-    "@vltpkg/dep-id": "1.0.1",
-    "@vltpkg/dss-breadcrumb": "1.0.1",
-    "@vltpkg/error-cause": "1.0.1",
-    "@vltpkg/fast-split": "1.0.1",
-    "@vltpkg/graph-run": "1.0.1",
-    "@vltpkg/init": "1.0.1",
-    "@vltpkg/output": "1.0.1",
-    "@vltpkg/package-info": "1.0.1",
-    "@vltpkg/package-json": "1.0.1",
-    "@vltpkg/pick-manifest": "1.0.1",
-    "@vltpkg/query": "1.0.1",
-    "@vltpkg/rollback-remove": "1.0.1",
-    "@vltpkg/run": "1.0.1",
-    "@vltpkg/satisfies": "1.0.1",
-    "@vltpkg/security-archive": "1.0.1",
-    "@vltpkg/spec": "1.0.1",
-    "@vltpkg/types": "1.0.1",
-    "@vltpkg/vlt-json": "1.0.1",
-    "@vltpkg/workspaces": "1.0.1",
+    "@vltpkg/cmd-shim": "1.0.2",
+    "@vltpkg/dep-id": "1.0.2",
+    "@vltpkg/dss-breadcrumb": "1.0.2",
+    "@vltpkg/error-cause": "1.0.2",
+    "@vltpkg/fast-split": "1.0.2",
+    "@vltpkg/graph-run": "1.0.2",
+    "@vltpkg/init": "1.0.2",
+    "@vltpkg/output": "1.0.2",
+    "@vltpkg/package-info": "1.0.2",
+    "@vltpkg/package-json": "1.0.2",
+    "@vltpkg/pick-manifest": "1.0.2",
+    "@vltpkg/query": "1.0.2",
+    "@vltpkg/rollback-remove": "1.0.2",
+    "@vltpkg/run": "1.0.2",
+    "@vltpkg/satisfies": "1.0.2",
+    "@vltpkg/security-archive": "1.0.2",
+    "@vltpkg/spec": "1.0.2",
+    "@vltpkg/types": "1.0.2",
+    "@vltpkg/vlt-json": "1.0.2",
+    "@vltpkg/workspaces": "1.0.2",
     "path-scurry": "^2.0.1",
     "promise-call-limit": "^3.0.2"
   },