@zowe/db2-for-zowe-cli 6.1.18 → 6.1.19

package/node_modules/adm-zip/adm-zip.js

@@ -498,7 +498,11 @@ module.exports = function (/**String*/ input, /** object */ options) {
         addLocalFolderAsync2: function (options, callback) {
             const self = this;
             options = typeof options === "object" ? options : { localPath: options };
-            const localPath = pth.resolve(fixPath(options.localPath));
+            // Resolve the local filesystem path with the platform resolver. Do NOT
+            // run it through fixPath: that normalizes ZIP-internal paths to POSIX
+            // and prepends "/", which turns a Windows path like C:\dir into
+            // \C:\dir, so readdir finds nothing and the archive comes out empty.
+            const localPath = pth.resolve(options.localPath);
             let { zipPath, filter, namefix } = options;
 
             if (filter instanceof RegExp) {
@@ -533,14 +537,21 @@ module.exports = function (/**String*/ input, /** object */ options) {
 
             filetools.fs.open(localPath, "r", function (err) {
                 if (err && err.code === "ENOENT") {
-                    callback(undefined, Utils.Errors.FILE_NOT_FOUND(localPath));
+                    // callback is (err, done); errors belong in the first argument,
+                    // otherwise addLocalFolderPromise treats the error as "done" and
+                    // resolves instead of rejecting.
+                    callback(Utils.Errors.FILE_NOT_FOUND(localPath), false);
                 } else if (err) {
-                    callback(undefined, err);
+                    callback(err, false);
                 } else {
                     filetools.findFilesAsync(localPath, function (err, fileEntries) {
-                        if (err) return callback(err);
+                        if (err) return callback(err, false);
                         fileEntries = fileEntries.filter((dir) => filter(relPathFix(dir)));
-                        if (!fileEntries.length) callback(undefined, false);
+                        // Nothing to add (empty folder or everything filtered out) is a
+                        // success, not an error. Report done and stop, otherwise the
+                        // reduce below runs and the callback fires a second time -- and
+                        // signalling done=false left addLocalFolderPromise hanging.
+                        if (!fileEntries.length) return callback(undefined, true);
 
                         setImmediate(
                             fileEntries.reverse().reduce(function (next, entry) {
@@ -575,7 +586,7 @@ module.exports = function (/**String*/ input, /** object */ options) {
         addLocalFolderPromise: function (localPath, props) {
             return new Promise((resolve, reject) => {
                 this.addLocalFolderAsync2(Object.assign({ localPath }, props), (err, done) => {
-                    if (err) reject(err);
+                    if (err) return reject(err);
                     if (done) resolve(this);
                 });
             });
@@ -709,6 +720,8 @@ module.exports = function (/**String*/ input, /** object */ options) {
                     // collapsed subdirectories together (issue #306).
                     var name = canonical(maintainEntryPath ? child.entryName : child.entryName.substring(item.entryName.length));
                     var childName = sanitize(targetPath, name);
+                    // reject writing through a pre-existing symlink inside the target
+                    filetools.assertPathSafe(targetPath, childName);
                     // The reverse operation for attr depend on method addFile()
                     const fileAttr = keepOriginalPermission ? child.header.fileAttr : undefined;
                     filetools.writeFileTo(childName, content, overwrite, fileAttr);
@@ -719,6 +732,9 @@ module.exports = function (/**String*/ input, /** object */ options) {
             var content = item.getData(_zip.password);
             if (!content) throw Utils.Errors.CANT_EXTRACT_FILE();
 
+            // reject writing through a pre-existing symlink inside the target
+            filetools.assertPathSafe(targetPath, target);
+
             if (filetools.fs.existsSync(target) && !overwrite) {
                 throw Utils.Errors.CANT_OVERRIDE();
             }
@@ -775,6 +791,8 @@ module.exports = function (/**String*/ input, /** object */ options) {
             const dirEntries = [];
             _zip.entries.forEach(function (entry) {
                 var entryName = sanitize(targetPath, canonical(entry.entryName));
+                // reject writing through a pre-existing symlink inside the target
+                filetools.assertPathSafe(targetPath, entryName);
                 if (entry.isDirectory) {
                     filetools.makeDir(entryName);
                     // defer restoring the directory permission until its files are written
@@ -854,6 +872,8 @@ module.exports = function (/**String*/ input, /** object */ options) {
                 // The reverse operation for attr depend on method addFile()
                 const dirAttr = keepOriginalPermission ? entry.header.fileAttr : undefined;
                 try {
+                    // reject writing through a pre-existing symlink inside the target
+                    filetools.assertPathSafe(targetPath, dirPath);
                     filetools.makeDir(dirPath);
                 } catch (er) {
                     callback(getError("Unable to create folder", dirPath));
@@ -890,6 +910,12 @@ module.exports = function (/**String*/ input, /** object */ options) {
                     } else {
                         const entryName = pth.normalize(canonical(entry.entryName));
                         const filePath = sanitize(targetPath, entryName);
+                        try {
+                            // reject writing through a pre-existing symlink inside the target
+                            filetools.assertPathSafe(targetPath, filePath);
+                        } catch (er) {
+                            return next(er);
+                        }
                         entry.getDataAsync(function (content, err_1) {
                             if (err_1) {
                                 next(err_1);

package/node_modules/adm-zip/headers/entryHeader.js

@@ -185,7 +185,12 @@ module.exports = function () {
 
         // get Unix file permissions
         get fileAttr() {
-            return (_attr || 0) >> 16 & 0xfff;
+            // Mask to the 9 rwxrwxrwx bits only. The setuid (0o4000), setgid
+            // (0o2000) and sticky (0o1000) bits are attacker-controlled archive
+            // metadata; preserving them on extraction (keepOriginalPermission)
+            // lets a crafted zip plant a setuid-root binary when extracting as
+            // root, a local privilege escalation (GHSA-679w-jf3m-wh39).
+            return ((_attr || 0) >> 16) & 0o777;
         },
 
         get offset() {
@@ -212,6 +217,13 @@ module.exports = function () {
         },
 
         loadLocalHeaderFromBinary: function (/*Buffer*/ input) {
+            // The LOC offset comes from the central directory and is attacker
+            // controlled. Reject one that would read past the end of the buffer,
+            // otherwise readUInt32LE below throws a raw RangeError instead of a
+            // clean INVALID_LOC (and escapes the async error path).
+            if (_offset < 0 || _offset + Constants.LOCHDR > input.length) {
+                throw Utils.Errors.INVALID_LOC();
+            }
             var data = input.slice(_offset, _offset + Constants.LOCHDR);
             // 30 bytes and should start with "PK\003\004"
             if (data.readUInt32LE(0) !== Constants.LOCSIG) {

package/node_modules/adm-zip/methods/inflater.js

@@ -1,8 +1,15 @@
 const version = +(process?.versions?.node ?? "").split(".")[0] || 0;
+const Errors = require("../util/errors");
 
 module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
     var zlib = require("zlib");
-    const option = version >= 15 && expectedLength > 0 ? { maxOutputLength: expectedLength } : {};
+    // Cap decompression output at the entry's declared uncompressed size to bound
+    // decompression bombs (CVE-2026-39244). A declared size of 0 must not disable
+    // the cap: a genuinely empty entry inflates to 0 bytes, so a 1-byte floor
+    // still lets it through while stopping a bomb that lies about its size
+    // (GHSA-rcw4-f5rp-g42v). zlib requires maxOutputLength >= 1.
+    const maxOutputLength = expectedLength > 0 ? expectedLength : 1;
+    const option = version >= 15 ? { maxOutputLength } : {};
 
     return {
         inflate: function () {
@@ -12,12 +19,35 @@ module.exports = function (/*Buffer*/ inbuf, /*number*/ expectedLength) {
         inflateAsync: function (/*Function*/ callback) {
             var tmp = zlib.createInflateRaw(option),
                 parts = [],
-                total = 0;
+                total = 0,
+                done = false;
+            const fail = function (err) {
+                if (done) return;
+                done = true;
+                tmp.destroy();
+                callback && callback(Buffer.alloc(0), err);
+            };
+            // Route stream errors (e.g. Z_DATA_ERROR on malformed input) through the
+            // callback. Without an "error" listener zlib re-throws the event as an
+            // uncaught exception on a later tick, crashing the host process instead
+            // of failing the call (GHSA-8238-w5pm-2374).
+            tmp.on("error", function (err) {
+                fail(err);
+            });
             tmp.on("data", function (data) {
-                parts.push(data);
+                if (done) return;
                 total += data.length;
+                // The streaming API ignores maxOutputLength, so enforce the cap by
+                // hand; otherwise the async path decompresses without limit while the
+                // sync path is capped (GHSA-v429-h5qx-84wm, GHSA-c6fg-446q-cg94).
+                if (total > maxOutputLength) {
+                    return fail(Errors.MAX_OUTPUT_EXCEEDED());
+                }
+                parts.push(data);
             });
             tmp.on("end", function () {
+                if (done) return;
+                done = true;
                 var buf = Buffer.alloc(total),
                     written = 0;
                 buf.fill(0);

package/node_modules/adm-zip/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adm-zip",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Javascript implementation of zip for nodejs with support for electron original-fs. Allows user to create or extract zip files both in memory or to/from disk",
   "scripts": {
     "test": "mocha -R spec",
@@ -49,7 +49,7 @@
   "devDependencies": {
     "chai": "^6.2.2",
     "iconv-lite": "^0.7.2",
-    "mocha": "12.0.0-beta-10",
+    "mocha": "^12.0.0",
     "prettier": "^3.8.1",
     "rimraf": "^3.0.2"
   }

package/node_modules/adm-zip/util/errors.js

@@ -12,6 +12,7 @@ const errors = {
     /* ZipEntry error messages*/
     NO_DATA: "Nothing to decompress",
     BAD_CRC: "CRC32 checksum failed {0}",
+    MAX_OUTPUT_EXCEEDED: "Decompressed data exceeds the declared uncompressed size",
     FILE_IN_THE_WAY: "There is a file in the way: {0}",
     UNKNOWN_METHOD: "Invalid/unsupported compression method",
 
@@ -33,11 +34,13 @@ const errors = {
     DISK_ENTRY_TOO_LARGE: "Number of disk entries is too large",
     NO_ZIP: "No zip file was loaded",
     NO_ENTRY: "Entry doesn't exist",
+    DUPLICATE_ENTRY: "Duplicate entry name {0}",
     DIRECTORY_CONTENT_ERROR: "A directory cannot have content",
     FILE_NOT_FOUND: 'File not found: "{0}"',
     NOT_IMPLEMENTED: "Not implemented",
     INVALID_FILENAME: "Invalid filename",
     INVALID_FORMAT: "Invalid or unsupported zip format. No END header found",
+    ZIP64_VALUE_TOO_LARGE: "Zip64 value exceeds the maximum safe integer",
     INVALID_PASS_PARAM: "Incompatible password parameter",
     WRONG_PASSWORD: "Wrong Password",
 

package/node_modules/adm-zip/util/utils.js

@@ -159,8 +159,59 @@ Utils.prototype.writeFileToAsync = function (/*String*/ path, /*Buffer*/ content
     });
 };
 
+// Guard extraction against writing through a symlink that already exists inside
+// the target directory. sanitize() only proves the textual path stays under the
+// root; it cannot see that a component on disk is a symlink pointing elsewhere,
+// so open()/mkdir() would follow it and write outside the root. Walk every path
+// component strictly below root and reject any that is a symlink. Components at
+// or above root are the caller's own choice and are left untouched, so a root
+// that itself lives under a symlink (e.g. /tmp on macOS) still extracts.
+Utils.prototype.assertPathSafe = function (/*String*/ root, /*String*/ target) {
+    const self = this;
+    if (typeof self.fs.lstatSync !== "function") return;
+
+    const resolvedRoot = pth.resolve(root);
+    const resolvedTarget = pth.resolve(target);
+    if (resolvedTarget === resolvedRoot) return;
+
+    const rel = pth.relative(resolvedRoot, resolvedTarget);
+    // Not under root: sanitize() is responsible for that case; nothing to walk.
+    if (!rel || rel === ".." || rel.startsWith(".." + pth.sep) || pth.isAbsolute(rel)) return;
+
+    let cur = resolvedRoot;
+    for (const part of rel.split(pth.sep)) {
+        if (!part || part === ".") continue;
+        cur = pth.join(cur, part);
+        let stat;
+        try {
+            stat = self.fs.lstatSync(cur);
+        } catch (e) {
+            break; // component does not exist yet: nothing below it can be a symlink
+        }
+        if (stat.isSymbolicLink()) throw Errors.FILE_IN_THE_WAY(`"${cur}"`);
+    }
+};
+
 Utils.prototype.findFiles = function (/*String*/ path) {
     const self = this;
+    const canLstat = typeof self.fs.lstatSync === "function";
+    const rootReal = self.fs.realpathSync(path);
+
+    // A symlink whose target lies outside the folder being archived must not be
+    // followed: statSync would dereference it and copy the target's contents into
+    // the archive, disclosing files outside the root (GHSA-wx42-xcp7-pgr4). Allow
+    // symlinks that resolve to a location inside the root, reject any that escape.
+    function escapesRoot(/*String*/ p) {
+        if (!canLstat) return false;
+        if (!self.fs.lstatSync(p).isSymbolicLink()) return false;
+        let real;
+        try {
+            real = self.fs.realpathSync(p);
+        } catch (e) {
+            return true; // dangling or unresolvable symlink: do not follow
+        }
+        return !(real === rootReal || real.startsWith(rootReal + pth.sep));
+    }
 
     function findSync(/*String*/ dir, /*RegExp*/ pattern, /*Boolean*/ recursive, /*Set*/ visited) {
         if (typeof pattern === "boolean") {
@@ -170,6 +221,9 @@ Utils.prototype.findFiles = function (/*String*/ path) {
         let files = [];
         self.fs.readdirSync(dir).forEach(function (file) {
             const path = pth.join(dir, file);
+
+            if (escapesRoot(path)) return;
+
             const stat = self.fs.statSync(path);
 
             if (!pattern || pattern.test(path)) {
@@ -191,7 +245,7 @@ Utils.prototype.findFiles = function (/*String*/ path) {
         return files;
     }
 
-    return findSync(path, undefined, true, new Set([self.fs.realpathSync(path)]));
+    return findSync(path, undefined, true, new Set([rootReal]));
 };
 
 /**
@@ -217,6 +271,25 @@ Utils.prototype.findFilesAsync = function (dir, cb) {
         cb(err, err ? undefined : results);
     };
 
+    const canLstat = typeof self.fs.lstat === "function";
+    let rootReal = null;
+
+    // Reject a symlink whose target escapes the root being archived, so its
+    // contents are not dereferenced and copied into the archive
+    // (GHSA-wx42-xcp7-pgr4). A symlink resolving to a location inside the root is
+    // allowed; a dangling or escaping one is skipped. Calls back (err, escapes).
+    const escapesRoot = function (file, cb) {
+        if (!canLstat) return cb(null, false);
+        self.fs.lstat(file, function (err, lst) {
+            if (err) return cb(err);
+            if (!lst || !lst.isSymbolicLink()) return cb(null, false);
+            self.fs.realpath(file, function (err, real) {
+                if (err) return cb(null, true); // dangling: do not follow
+                cb(null, !(real === rootReal || real.startsWith(rootReal + pth.sep)));
+            });
+        });
+    };
+
     // Descend by resolved real path and skip directories already visited, so a
     // symlink pointing back to an ancestor cannot recurse forever (issue #541).
     const walk = function (dir, visited, done) {
@@ -226,27 +299,34 @@ Utils.prototype.findFilesAsync = function (dir, cb) {
             if (!pending) return done();
             list.forEach(function (name) {
                 const file = pth.join(dir, name);
-                self.fs.stat(file, function (err, stat) {
+                escapesRoot(file, function (err, escapes) {
                     if (err) return done(err);
-                    if (!stat) {
-                        if (!--pending) done();
-                        return;
-                    }
-                    results.push(pth.normalize(file) + (stat.isDirectory() ? self.sep : ""));
-                    if (!stat.isDirectory()) {
+                    if (escapes) {
                         if (!--pending) done();
                         return;
                     }
-                    self.fs.realpath(file, function (err, realDir) {
+                    self.fs.stat(file, function (err, stat) {
                         if (err) return done(err);
-                        if (visited.has(realDir)) {
+                        if (!stat) {
                             if (!--pending) done();
                             return;
                         }
-                        visited.add(realDir);
-                        walk(file, visited, function (err) {
-                            if (err) return done(err);
+                        results.push(pth.normalize(file) + (stat.isDirectory() ? self.sep : ""));
+                        if (!stat.isDirectory()) {
                             if (!--pending) done();
+                            return;
+                        }
+                        self.fs.realpath(file, function (err, realDir) {
+                            if (err) return done(err);
+                            if (visited.has(realDir)) {
+                                if (!--pending) done();
+                                return;
+                            }
+                            visited.add(realDir);
+                            walk(file, visited, function (err) {
+                                if (err) return done(err);
+                                if (!--pending) done();
+                            });
                         });
                     });
                 });
@@ -256,6 +336,7 @@ Utils.prototype.findFilesAsync = function (dir, cb) {
 
     self.fs.realpath(dir, function (err, realDir) {
         if (err) return finish(err);
+        rootReal = realDir;
         walk(dir, new Set([realDir]), finish);
     });
 };
@@ -365,7 +446,14 @@ Utils.toBuffer = function toBuffer(/*buffer, Uint8Array, string*/ input, /* func
 Utils.readBigUInt64LE = function (/*Buffer*/ buffer, /*int*/ index) {
     const lo = buffer.readUInt32LE(index);
     const hi = buffer.readUInt32LE(index + 4);
-    return hi * 0x100000000 + lo;
+    const value = hi * 0x100000000 + lo;
+    // The result is a JS number, so values above 2^53 - 1 cannot be represented
+    // exactly. These are zip64 sizes/offsets/counts used as buffer indices; a
+    // silently rounded value would misparse the archive. Reject instead.
+    if (value > Number.MAX_SAFE_INTEGER) {
+        throw Errors.ZIP64_VALUE_TOO_LARGE();
+    }
+    return value;
 };
 
 Utils.writeBigUInt64LE = function (/*Buffer*/ buffer, /*Number*/ value, /*int*/ index) {

package/node_modules/adm-zip/zipEntry.js

@@ -25,7 +25,16 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
             return Buffer.alloc(0);
         }
         _extralocal = _centralHeader.loadLocalHeaderFromBinary(input);
-        return input.slice(_centralHeader.realDataOffset, _centralHeader.realDataOffset + _centralHeader.compressedSize);
+        const dataOffset = _centralHeader.realDataOffset;
+        const dataEnd = dataOffset + _centralHeader.compressedSize;
+        // The offsets and sizes come from attacker-controlled headers. Require the
+        // declared compressed extent to be fully present rather than letting slice()
+        // silently clamp to a short buffer (which only surfaces later as a CRC
+        // failure). Fail loudly with a header error instead (GHSA-wwrv-q5gf-5843).
+        if (dataOffset < 0 || dataEnd < dataOffset || dataEnd > input.length) {
+            throw Utils.Errors.INVALID_LOC();
+        }
+        return input.slice(dataOffset, dataEnd);
     }
 
     function crc32OK(data) {
@@ -60,19 +69,32 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
             return Buffer.alloc(0);
         }
 
-        var compressedData = getCompressedDataFromZip();
+        var compressedData;
+        try {
+            compressedData = getCompressedDataFromZip();
 
-        if (compressedData.length === 0) {
-            // File is empty, nothing to decompress.
-            if (async && callback) callback(compressedData);
-            return compressedData;
-        }
+            if (compressedData.length === 0) {
+                // File is empty, nothing to decompress.
+                if (async && callback) callback(compressedData);
+                return compressedData;
+            }
 
-        if (_centralHeader.encrypted) {
-            if ("string" !== typeof pass && !Buffer.isBuffer(pass)) {
-                throw Utils.Errors.INVALID_PASS_PARAM();
+            if (_centralHeader.encrypted) {
+                if ("string" !== typeof pass && !Buffer.isBuffer(pass)) {
+                    throw Utils.Errors.INVALID_PASS_PARAM();
+                }
+                compressedData = Methods.ZipCrypto.decrypt(compressedData, _centralHeader, pass);
+            }
+        } catch (err) {
+            // These synchronous parse/setup steps run before any callback fires.
+            // In async mode a malformed local header (e.g. a bad LOC offset) would
+            // otherwise throw out of getDataAsync and bypass the callback error
+            // channel, crashing the caller. Route it through the callback instead.
+            if (async && callback) {
+                callback(Buffer.alloc(0), err);
+                return Buffer.alloc(0);
             }
-            compressedData = Methods.ZipCrypto.decrypt(compressedData, _centralHeader, pass);
+            throw err;
         }
 
         var data;
@@ -107,13 +129,16 @@ module.exports = function (/** object */ options, /*Buffer*/ input) {
                     }
                     return data;
                 } else {
-                    inflater.inflateAsync(function (result) {
-                        if (callback) {
-                            if (!crc32OK(result)) {
-                                callback(result, Utils.Errors.BAD_CRC()); //si added error
-                            } else {
-                                callback(result);
-                            }
+                    inflater.inflateAsync(function (result, err) {
+                        if (!callback) return;
+                        if (err) {
+                            // surface inflater/stream failures instead of validating
+                            // the empty placeholder buffer against the CRC
+                            callback(Buffer.alloc(0), err);
+                        } else if (!crc32OK(result)) {
+                            callback(result, Utils.Errors.BAD_CRC()); //si added error
+                        } else {
+                            callback(result);
                         }
                     });
                 }

package/node_modules/adm-zip/zipFile.js

@@ -78,6 +78,16 @@ module.exports = function (/*Buffer|null*/ inBuffer, /** object */ options) {
 
             index += entry.header.centralHeaderSize;
 
+            // Reject archives that declare the same entry name twice. adm-zip keeps
+            // every entry in entryList but only the last in entryTable, so getEntry()
+            // (table) and extractAllTo() (list) could resolve one name to different
+            // content: an app that validates entry bytes via getEntry() before
+            // extracting could approve one file while a different one lands on disk
+            // (GHSA-p634-w6r4-rjp2). Fail closed on the ambiguity.
+            if (entry.entryName in entryTable) {
+                throw Utils.Errors.DUPLICATE_ENTRY(`"${entry.entryName}"`);
+            }
+
             entryList[i] = entry;
             entryTable[entry.entryName] = entry;
         }