@vltpkg/types 1.0.1 → 1.0.2

package/dist/index.d.ts

@@ -428,7 +428,7 @@ export declare const asManifest: (m: unknown, from?: (...a: unknown[]) => any) =
  * contains normalized author, bugs, funding, contributors, keywords and
  * version fields.
  */
-export declare const normalizeManifest: <T extends Manifest | ManifestRegistry>(manifest: T) => SomeNormalizedManifest<T>;
+export declare const normalizeManifest: <T extends Manifest | ManifestRegistry>(manifest: T, from?: string) => SomeNormalizedManifest<T>;
 /**
  * Type guard to check if a value is a {@link NormalizedManifest}.
  */

package/dist/index.js

@@ -1,5 +1,9 @@
 import { error } from '@vltpkg/error-cause';
 import { Version } from '@vltpkg/semver';
+import { assertPathSafeName } from '@vltpkg/spec/browser';
+import { posix } from 'node:path';
+import { debuglog } from 'node:util';
+const debug = debuglog('vlt');
 /**
  * Normalize a single funding entry to a consistent format.
  */
@@ -469,6 +473,37 @@ export const isNormalizedLibc = (o) => {
             !item.startsWith(' ') &&
             !item.endsWith(' ')));
 };
+const unixify = (ref) => ref.replace(/[\\:]/g, '/');
+/**
+ * Clamp a manifest-supplied relative path into the package dir. The result
+ * is always a `..`-free, non-absolute path, so resolving it under the
+ * package dir cannot escape. Returns `''` for `.`, `..` and `''`.
+ */
+const secure = (ref) => {
+    const s = unixify(posix.join('.', posix.join('/', unixify(ref))));
+    return s === './' ? '' : s;
+};
+/**
+ * Clamp bin keys (which become path segments under `.bin/`) and bin values
+ * (resolved under the package dir) into safe relative paths.
+ */
+const secureBinPaths = (bin) => {
+    const res = {};
+    for (const [key, val] of Object.entries(bin)) {
+        // types say string, but manifests are untrusted
+        const v = typeof val === 'string' ? secure(val) : '';
+        const k = posix.basename(secure(key));
+        if (!k || !v) {
+            debug('dropped unusable bin entry', key, val);
+            continue;
+        }
+        if (k !== key || v !== val) {
+            debug('rewrote unsafe bin entry', key, val, '->', k, v);
+        }
+        res[k] = v;
+    }
+    return res;
+};
 /**
  * Normalizes the bin paths.
  */
@@ -477,10 +512,10 @@ export const normalizeBinPaths = (manifest) => {
     if (bin) {
         if (name && typeof bin === 'string') {
             const [_scope, pkg] = parseScope(name);
-            return { [pkg]: bin };
+            return secureBinPaths({ [pkg]: bin });
         }
         else if (typeof bin === 'object') {
-            return bin;
+            return secureBinPaths(bin);
         }
     }
 };
@@ -593,12 +628,16 @@ const normalizeManifestCache = new WeakMap();
  * contains normalized author, bugs, funding, contributors, keywords and
  * version fields.
  */
-export const normalizeManifest = (manifest) => {
+export const normalizeManifest = (manifest, from) => {
     // Check cache first using manifest object reference
     const cached = normalizeManifestCache.get(manifest);
     if (cached) {
         return cached;
     }
+    // the single choke point every manifest passes through, from any source
+    if (manifest.name !== undefined) {
+        assertPathSafeName(manifest.name, from);
+    }
     manifest = fixManifestVersion(manifest);
     const normalizedAuthor = parsePerson(manifest.author);
     const normalizedFunding = normalizeFunding(manifest.funding);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vltpkg/types",
   "description": "definitions for some of vlt's core types",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vltpkg/vltpkg.git",
@@ -13,10 +13,10 @@
     "url": "http://vlt.sh"
   },
   "dependencies": {
-    "@vltpkg/dep-id": "1.0.1",
-    "@vltpkg/error-cause": "1.0.1",
-    "@vltpkg/semver": "1.0.1",
-    "@vltpkg/spec": "1.0.1"
+    "@vltpkg/dep-id": "1.0.2",
+    "@vltpkg/error-cause": "1.0.2",
+    "@vltpkg/semver": "1.0.2",
+    "@vltpkg/spec": "1.0.2"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.1",