appium-mac2-driver 4.4.0 → 4.5.1

package/node_modules/@appium/support/lib/zip.ts

@@ -1,4 +1,3 @@
-import {createWriteStream} from 'node:fs';
 import path from 'node:path';
 import stream from 'node:stream';
 import {text} from 'node:stream/consumers';
@@ -23,6 +22,8 @@ const ZIP_MAGIC = 'PK';
 const IFMT = 0b1111000000000000;
 const IFDIR = 0b0100000000000000;
 const IFLNK = 0b1010000000000000;
+// Limit traversal to stop symlink cycles.
+const MAX_SYMLINK_TRAVERSALS = 40;
 
 export interface ExtractAllOptions {
   /**
@@ -94,7 +95,14 @@ interface ZipExtractorOptions {
   defaultFileMode?: string;
 }
 
-type OpenReadStreamFn = (entry: yauzl.Entry) => Promise<NodeJS.ReadableStream>;
+type OpenReadStreamFn = (entry: yauzl.Entry) => Promise<stream.Readable>;
+
+interface SymlinkTarget {
+  linkTarget: string;
+  linkParentDir: string;
+  fileName: string;
+  missingPaths: Set<string>;
+}
 
 // This class is mostly copied from https://github.com/maxogden/extract-zip/blob/master/index.js
 class ZipExtractor {
@@ -103,6 +111,8 @@ class ZipExtractor {
   private readonly zipPath: string;
   private readonly opts: ZipExtractorOptions;
   private canceled = false;
+  // Normalized missing-path keys -> links to recheck when those paths become symlinks.
+  private readonly symlinkDependents = new Map<string, Set<SymlinkTarget>>();
 
   constructor(sourcePath: string, opts: ZipExtractorOptions) {
     this.zipPath = sourcePath;
@@ -154,8 +164,6 @@ class ZipExtractor {
       return;
     }
 
-    const {dir} = this.opts;
-
     // convert external file attr int into a fs stat mode int
     const mode = (entry.externalFileAttributes >> 16) & 0xffff;
     // check if it's a symlink or dir (using stat mode constants)
@@ -170,77 +178,25 @@ class ZipExtractor {
     const procMode = this.getExtractedMode(mode, isDir) & 0o777;
     // always ensure folders are created
     const destDir = isDir ? dest : path.dirname(dest);
-    const realDestDir = await this.ensureDirWithinRoot(destDir, fileName, isDir ? procMode : undefined);
+    const {dir} = this.opts;
+    const realDestDir = await ensureDirWithinRoot(dir, destDir, fileName, isDir ? procMode : undefined);
     if (isDir) {
       return;
     }
 
-    const readStream = await this.openReadStream(entry);
     if (isSymlink) {
-      const link = await text(readStream);
-      const resolvedLink = path.resolve(realDestDir, link);
-      if (!isContainedPath(resolvedLink, dir)) {
-        throw new Error(`Out of bound symlink target "${link}" found while processing file ${fileName}`);
-      }
-      await fs.symlink(link, dest);
+      const linkTarget = await text(await this.openReadStream(entry));
+      await this.createValidatedSymlink(linkTarget, dest, realDestDir, fileName);
     } else {
-      await this.assertFileDestinationWithinRoot(dest, realDestDir, fileName);
-      await pipeline(readStream, fs.createWriteStream(dest, {mode: procMode}));
-    }
-  }
-
-  private async ensureDirWithinRoot(dirPath: string, fileName: string, mode?: number): Promise<string> {
-    const {dir} = this.opts;
-    if (!isContainedPath(dirPath, dir)) {
-      throw new Error(`Out of bound path "${dirPath}" found while processing file ${fileName}`);
-    }
-
-    const relativePath = path.relative(dir, dirPath);
-    if (!relativePath) {
-      return dir;
-    }
-
-    let currentPath = dir;
-    for (const segment of relativePath.split(path.sep)) {
-      currentPath = path.join(currentPath, segment);
+      await assertFileDestinationWithinRoot(dir, dest, realDestDir, fileName);
+      const readStream = await this.openReadStream(entry);
       try {
-        const [stats, realPath] = await Promise.all([fs.lstat(currentPath), fs.realpath(currentPath)]);
-        if (!isContainedPath(realPath, dir)) {
-          throw new Error(`Out of bound path "${currentPath}" found while processing file ${fileName}`);
-        }
-        if (!stats.isDirectory() && !stats.isSymbolicLink()) {
-          throw new Error(`Cannot create a directory over existing file "${currentPath}"`);
-        }
-      } catch (err: any) {
-        if (err.code !== 'ENOENT') {
-          throw err;
-        }
-        await fs.mkdir(currentPath, {mode});
+        await writeFileNoFollow(readStream, dest, procMode);
+      } finally {
+        // Opening the output may fail before pipeline takes ownership of the input.
+        readStream.destroy();
       }
     }
-
-    const realPath = await fs.realpath(dirPath);
-    if (!isContainedPath(realPath, dir)) {
-      throw new Error(`Out of bound path "${dirPath}" found while processing file ${fileName}`);
-    }
-    return realPath;
-  }
-
-  private async assertFileDestinationWithinRoot(dest: string, realDestDir: string, fileName: string): Promise<void> {
-    const {dir} = this.opts;
-    let realDest: string | null = null;
-    try {
-      realDest = await fs.realpath(dest);
-    } catch (err: any) {
-      if (err.code !== 'ENOENT') {
-        throw err;
-      }
-    }
-
-    realDest = realDest ?? path.resolve(realDestDir, path.basename(dest));
-    if (!isContainedPath(realDest, dir)) {
-      throw new Error(`Out of bound path "${dest}" found while processing file ${fileName}`);
-    }
   }
 
   private getExtractedMode(entryMode: number, isDir: boolean): number {
@@ -270,6 +226,207 @@ class ZipExtractor {
 
     return mode;
   }
+
+  /**
+   * Reject escaping targets or excessive traversal; return missing-path keys for later rechecks.
+   */
+  private async validateSymlinkTarget(
+    linkTarget: string,
+    linkParentDir: string,
+    fileName: string,
+  ): Promise<Set<string>> {
+    // Windows resolves drive-relative targets (`C:foo`) against the drive's CWD, not the link's parent
+    if (isWindows() && /^[A-Za-z]:/.test(linkTarget) && !path.win32.isAbsolute(linkTarget)) {
+      throw new Error(`Out of bound symlink target "${linkTarget}" found while processing file ${fileName}`);
+    }
+
+    // Resolve links before '..'; realpath alone cannot handle missing targets.
+    const separator = isWindows() ? /[\\/]+/ : /\/+/;
+    const targetRoot = path.isAbsolute(linkTarget) ? path.parse(linkTarget).root : '';
+    let resolvedPath = targetRoot || linkParentDir;
+    const remainingSegments = linkTarget.slice(targetRoot.length).split(separator);
+    const missingPaths = new Set<string>();
+    let followedLinks = 0;
+
+    while (remainingSegments.length) {
+      const segment = remainingSegments.shift();
+      if (!segment || segment === '.') {
+        continue;
+      }
+      if (segment === '..') {
+        resolvedPath = path.dirname(resolvedPath);
+        continue;
+      }
+
+      const candidatePath = path.join(resolvedPath, segment);
+      let nestedLinkTarget: string | null = null;
+      try {
+        const stats = await fs.lstat(candidatePath);
+        if (stats.isSymbolicLink()) {
+          nestedLinkTarget = await fs.readlink(candidatePath);
+        }
+      } catch (err: any) {
+        if (err.code !== 'ENOENT') {
+          throw err;
+        }
+        // An absent component may become a symlink in a later ZIP entry.
+        missingPaths.add(this.getSymlinkDependencyKey(candidatePath));
+      }
+
+      // Advance past ordinary or missing components.
+      if (nestedLinkTarget === null) {
+        resolvedPath = candidatePath;
+        continue;
+      }
+
+      followedLinks += 1;
+      if (followedLinks > MAX_SYMLINK_TRAVERSALS) {
+        throw new Error(`Too many symlinks while processing file ${fileName}`);
+      }
+      // Resolve relative targets from the link's parent, absolute targets from their root.
+      if (path.isAbsolute(nestedLinkTarget)) {
+        resolvedPath = path.parse(nestedLinkTarget).root;
+        nestedLinkTarget = nestedLinkTarget.slice(resolvedPath.length);
+      }
+      remainingSegments.unshift(...nestedLinkTarget.split(separator));
+    }
+
+    if (!isContainedPath(resolvedPath, this.opts.dir)) {
+      throw new Error(`Out of bound symlink target "${linkTarget}" found while processing file ${fileName}`);
+    }
+    return missingPaths;
+  }
+
+  private updateSymlinkDependencies(target: SymlinkTarget, missingPaths: Set<string>): void {
+    for (const missingPath of target.missingPaths) {
+      const dependents = this.symlinkDependents.get(missingPath);
+      dependents?.delete(target);
+      if (!dependents?.size) {
+        this.symlinkDependents.delete(missingPath);
+      }
+    }
+    target.missingPaths = missingPaths;
+    for (const missingPath of missingPaths) {
+      let dependents = this.symlinkDependents.get(missingPath);
+      if (!dependents) {
+        dependents = new Set();
+        this.symlinkDependents.set(missingPath, dependents);
+      }
+      dependents.add(target);
+    }
+  }
+
+  private async createValidatedSymlink(
+    linkTarget: string,
+    dest: string,
+    linkParentDir: string,
+    fileName: string,
+  ): Promise<void> {
+    // Reject an escaping target before creating the link on disk.
+    await this.validateSymlinkTarget(linkTarget, linkParentDir, fileName);
+    await fs.symlink(linkTarget, dest);
+    try {
+      const target: SymlinkTarget = {linkTarget, linkParentDir, fileName, missingPaths: new Set()};
+      // Recheck for cycles and redirected forward references after creating the link.
+      const key = this.getSymlinkDependencyKey(path.join(linkParentDir, path.basename(dest)));
+      const affectedTargets = [target, ...(this.symlinkDependents.get(key) ?? [])];
+      for (const affectedTarget of affectedTargets) {
+        const missingPaths = await this.validateSymlinkTarget(
+          affectedTarget.linkTarget,
+          affectedTarget.linkParentDir,
+          affectedTarget.fileName,
+        );
+        this.updateSymlinkDependencies(affectedTarget, missingPaths);
+      }
+    } catch (err) {
+      // Roll back the link that invalidated a target.
+      await fs.unlink(dest);
+      throw err;
+    }
+  }
+
+  private getSymlinkDependencyKey(absolutePath: string): string {
+    // Normalize keys, not filesystem paths. Collisions only cause extra checks.
+    return absolutePath.normalize('NFD').toLowerCase();
+  }
+}
+
+async function ensureDirWithinRoot(dir: string, dirPath: string, fileName: string, mode?: number): Promise<string> {
+  if (!isContainedPath(dirPath, dir)) {
+    throw new Error(`Out of bound path "${dirPath}" found while processing file ${fileName}`);
+  }
+
+  const relativePath = path.relative(dir, dirPath);
+  if (!relativePath) {
+    return dir;
+  }
+
+  let currentPath = dir;
+  for (const segment of relativePath.split(path.sep)) {
+    currentPath = path.join(currentPath, segment);
+    try {
+      const [stats, realPath] = await Promise.all([fs.lstat(currentPath), fs.realpath(currentPath)]);
+      if (!isContainedPath(realPath, dir)) {
+        throw new Error(`Out of bound path "${currentPath}" found while processing file ${fileName}`);
+      }
+      if (!stats.isDirectory() && !stats.isSymbolicLink()) {
+        throw new Error(`Cannot create a directory over existing file "${currentPath}"`);
+      }
+    } catch (err: any) {
+      if (err.code !== 'ENOENT') {
+        throw err;
+      }
+      await fs.mkdir(currentPath, {mode});
+    }
+  }
+
+  const realPath = await fs.realpath(dirPath);
+  if (!isContainedPath(realPath, dir)) {
+    throw new Error(`Out of bound path "${dirPath}" found while processing file ${fileName}`);
+  }
+  return realPath;
+}
+
+async function assertFileDestinationWithinRoot(
+  dir: string,
+  dest: string,
+  realDestDir: string,
+  fileName: string,
+): Promise<void> {
+  let realDest: string | null = null;
+  try {
+    if ((await fs.lstat(dest)).isSymbolicLink()) {
+      throw new Error(`Cannot write a file over existing symlink "${dest}"`);
+    }
+    realDest = await fs.realpath(dest);
+  } catch (err: any) {
+    if (err.code !== 'ENOENT') {
+      throw err;
+    }
+  }
+
+  realDest = realDest ?? path.resolve(realDestDir, path.basename(dest));
+  if (!isContainedPath(realDest, dir)) {
+    throw new Error(`Out of bound path "${dest}" found while processing file ${fileName}`);
+  }
+}
+
+async function writeFileNoFollow(readStream: stream.Readable, dest: string, mode: number): Promise<void> {
+  const flags =
+    fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | (isWindows() ? 0 : fs.constants.O_NOFOLLOW);
+  let file;
+  try {
+    file = await fs.openFile(dest, flags, mode);
+  } catch (err) {
+    // pipeline has not taken ownership of the input yet
+    readStream.destroy();
+    throw err;
+  }
+  try {
+    await pipeline(readStream, file.createWriteStream());
+  } finally {
+    await file.close();
+  }
 }
 
 /**
@@ -322,16 +479,19 @@ export async function _extractEntryTo(
     throw new Error(`Out of bound path "${dstPath}" found while processing file ${fileName}`);
   }
 
+  // Same symlink-safe directory/file handling as in ZipExtractor
+  await fs.mkdirp(destDir);
+  const dir = await fs.realpath(destDir);
+  const dest = path.resolve(dir, path.relative(destDir, dstPath));
   if (fileName.endsWith('/')) {
-    if (!(await fs.exists(dstPath))) {
-      await fs.mkdirp(dstPath);
-    }
+    await ensureDirWithinRoot(dir, dest, fileName);
     return;
   }
-  await fs.mkdirp(path.dirname(dstPath));
+  const realDestDir = await ensureDirWithinRoot(dir, path.dirname(dest), fileName);
+  await assertFileDestinationWithinRoot(dir, dest, realDestDir, fileName);
 
   const readStream = await openReadStream(entry);
-  await pipeline(readStream, createWriteStream(dstPath, {flags: 'w'}));
+  await writeFileNoFollow(readStream, dest, 0o666);
 }
 
 /**