create-walle 0.10.1 → 0.10.2

package/template/shared/owner-write-safety.js

@@ -0,0 +1,135 @@
+'use strict';
+
+// Shared "no other account can write through this path" predicate for paths CTM and
+// Wall-E did not create themselves (a Codex sessions root, an enrolled provider root,
+// a data directory handed in by an installer, ~/.walle/data).
+//
+// The rule is Debian OpenSSH's `user-group-modes.patch` rule, adapted: world write is
+// never acceptable, and group write is acceptable ONLY when the owning group is the
+// current user's own one-member private group (the user-private-group scheme that
+// `pam_umask(8)` sets up as umask 002 on every Debian/Ubuntu/Fedora login). On a shared
+// group (`staff` on macOS, `users` on many hosts) the check is exactly as strict as
+// before.
+//
+// Accepted gap (same as the Debian patch): a group password held in `/etc/gshadow`
+// (usable through `newgrp`) and accounts that exist only in NSS (LDAP/SSSD) are invisible
+// to the `/etc/group` + `/etc/passwd` parse this module performs, so a gid that cannot be
+// proven from the local files is refused — the check always fails closed.
+
+const fs = require('node:fs');
+const os = require('node:os');
+
+const MAX_DB_BYTES = 1024 * 1024;
+const GROUP_PATH = '/etc/group';
+const PASSWD_PATH = '/etc/passwd';
+
+/** Default reader: one bounded read (≤ MAX_DB_BYTES), the fd always closed. */
+function _readBoundedFile(filePath) {
+  const fd = fs.openSync(filePath, 'r');
+  try {
+    const stat = fs.fstatSync(fd);
+    if (Number(stat.size) > MAX_DB_BYTES) {
+      throw new Error(`${filePath} is larger than ${MAX_DB_BYTES} bytes`);
+    }
+    return fs.readFileSync(fd, 'utf8');
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+// A seam explicitly passed as `null` means "this platform has no such call" (the Windows
+// shape); `undefined` means "use the process default".
+function _seam(deps, name, fallback) {
+  if (deps[name] === null) return null;
+  if (typeof deps[name] === 'function') return deps[name];
+  return typeof fallback === 'function' ? fallback : null;
+}
+
+// Split a local-database file into usable lines: blanks and `#` comments are skipped, and a
+// `+`/`-` NIS compat line makes the whole file unprovable (return null).
+function _usableLines(text) {
+  const lines = [];
+  for (const raw of String(text).split('\n')) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#')) continue;
+    if (line.startsWith('+') || line.startsWith('-')) return null;
+    lines.push(line);
+  }
+  return lines;
+}
+
+function _numericField(value) {
+  return /^\d+$/.test(value || '') ? Number(value) : null;
+}
+
+/** D-2: `gid` is the current user's one-member private group. Any doubt ⇒ false. */
+function isUserPrivateGroup(gid, deps = {}) {
+  try {
+    const getuid = _seam(deps, 'getuid', process.getuid);
+    const getgid = _seam(deps, 'getgid', process.getgid);
+    if (typeof getuid !== 'function' || typeof getgid !== 'function') return false;
+    const targetGid = _numericField(String(gid));
+    if (targetGid === null) return false;
+    if (Number(getgid()) !== targetGid) return false;
+    const uid = Number(getuid());
+    const usernameFn = _seam(deps, 'username', () => os.userInfo().username);
+    if (typeof usernameFn !== 'function') return false;
+    const username = String(usernameFn() || '');
+    if (!username) return false;
+    const readFile = _seam(deps, 'readFile', _readBoundedFile);
+    if (typeof readFile !== 'function') return false;
+
+    // (b) /etc/group: exactly one line with this gid, named after the login, members ⊆ {login}.
+    const groupLines = _usableLines(readFile(GROUP_PATH));
+    if (!groupLines) return false;
+    const groupEntries = [];
+    for (const line of groupLines) {
+      const fields = line.split(':');
+      const lineGid = fields.length >= 3 ? _numericField(fields[2]) : null;
+      if (lineGid === null || lineGid !== targetGid) continue;
+      if (fields.length !== 4) return false;
+      groupEntries.push({ name: fields[0], members: fields[3].split(',').map(m => m.trim()).filter(Boolean) });
+    }
+    if (groupEntries.length !== 1) return false;
+    const group = groupEntries[0];
+    if (group.name !== username) return false;
+    if (group.members.length > 1) return false;
+    if (group.members.length === 1 && group.members[0] !== username) return false;
+
+    // (c) /etc/passwd: every account whose primary gid is this gid is this uid, and one exists.
+    const passwdLines = _usableLines(readFile(PASSWD_PATH));
+    if (!passwdLines) return false;
+    let primaryAccounts = 0;
+    for (const line of passwdLines) {
+      const fields = line.split(':');
+      const lineGid = fields.length >= 4 ? _numericField(fields[3]) : null;
+      if (lineGid === null || lineGid !== targetGid) continue;
+      if (fields.length !== 7) return false;
+      primaryAccounts += 1;
+      const lineUid = _numericField(fields[2]);
+      if (lineUid === null || lineUid !== uid) return false;
+    }
+    if (primaryAccounts === 0) return false;
+    return true;
+  } catch {
+    /* expected: any unreadable or unparsable account database fails closed (D-3) */
+    return false;
+  }
+}
+
+/**
+ * True iff no account other than the current user can write through `stat`'s permission bits.
+ * Accepts fs.Stats (Number) and fs.BigIntStats (bigint) alike.
+ * @param {{ mode: number|bigint, gid: number|bigint }} stat
+ * @param {{ readFile?: (p: string) => string, getuid?: () => number, getgid?: () => number,
+ *           username?: () => string }} [deps]  test seams
+ * @returns {boolean}
+ */
+function isWritableOnlyByOwner(stat, deps = {}) {
+  const mode = Number(stat.mode);
+  if ((mode & 0o002) !== 0) return false; // world write is never acceptable
+  if ((mode & 0o020) === 0) return true; // no group write: no file is read
+  return isUserPrivateGroup(Number(stat.gid), deps);
+}
+
+module.exports = { isWritableOnlyByOwner, isUserPrivateGroup, MAX_DB_BYTES, _readBoundedFile };

package/template/shared/public-runtime.js

@@ -36,6 +36,11 @@ const os = require('node:os');
 const path = require('node:path');
 const { execFileSync } = require('node:child_process');
 
+// The ONE "no other account can write through this path" predicate, shared with CTM and Wall-E. It
+// is a relative SIBLING require on purpose: the mirror is byte-identical, so the same bytes resolve it
+// from `shared/` and from `create-walle/lib/`.
+const { isWritableOnlyByOwner } = require('./owner-write-safety');
+
 const {
   parseReleaseRuntimePolicy,
   releaseRuntimeArchive,
@@ -187,10 +192,13 @@ function publicRuntimeNpmEnv(nodeBin) {
 
 // ── the one cache-directory admission ───────────────────────────────────────────────────────────
 /**
- * Assert that `dir` is a REAL directory (never a link), owned by the current user, and not
- * group/other writable. Ancestors ABOVE the owned cache boundary are deliberately not inspected: a
- * system path or a sticky ancestor is not this installer's ownership requirement, and pretending
- * otherwise would refuse every legitimate `~/.walle` under a shared parent.
+ * Assert that `dir` is a REAL directory (never a link), owned by the current user, and writable only
+ * by its owner (a user-private group counts as the owner: world write is never acceptable, and group
+ * write is acceptable only when the owning group is the user's own one-member private group, the
+ * umask-002 scheme of a Debian/Ubuntu/Fedora login). Ancestors ABOVE the owned cache boundary are
+ * deliberately not inspected: a system path or a sticky ancestor is not this installer's ownership
+ * requirement, and pretending otherwise would refuse every legitimate `~/.walle` under a shared
+ * parent.
  */
 function assertOwnedCacheDirectory(fsOps, dir, phase) {
   let stat;
@@ -202,7 +210,7 @@ function assertOwnedCacheDirectory(fsOps, dir, phase) {
   if (stat.isSymbolicLink() || !stat.isDirectory()) {
     throw refuse(phase, 'public runtime cache directory is not a real directory');
   }
-  if ((Number(stat.mode) & 0o022) !== 0) {
+  if (!isWritableOnlyByOwner(stat)) {
     throw refuse(phase, 'public runtime cache directory is group or other writable');
   }
   if (typeof process.getuid === 'function' && Number(stat.uid) !== process.getuid()) {

package/template/shared/release-schema.json

@@ -9,7 +9,7 @@
         21, 22, 23, 24, 25, 26, 27, 28, 29, 30,
         31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
         41, 42, 43, 44, 45, 46, 47, 48, 49, 50,
-        51, 52, 53, 54, 55
+        51, 52, 53, 54, 55, 56
       ]
     },
     "walle": {
@@ -24,7 +24,8 @@
         61, 62, 63, 64, 65, 66, 67, 68, 69, 70,
         71, 72, 73, 74, 75, 76, 77, 78, 79, 80,
         81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96,
-        97, 98, 99
+        97, 98, 99, 100,
+        101
       ]
     }
   }

package/template/shared/report-citations.js

@@ -0,0 +1,14 @@
+'use strict';
+// Distinct `file:line` citations in a report. Same regex as round 1's wall-e/lib/helper-rules/label.js:14,
+// moved here so CTM (the counter) and Wall-E (the labeller) cannot drift. Built per call: a module-level /g
+// literal would carry lastIndex between calls.
+const CITATION_SOURCE = String.raw`(?:^|[\s|\x60(])([\w.\/-]+\.[A-Za-z0-9]+):(\d+)\b`;
+function citationRegex() { return new RegExp(CITATION_SOURCE, 'gm'); }
+/** @param {string} text @returns {number} distinct `file:line` pairs; 0 for non-strings */
+function countReportCitations(text) {
+  if (typeof text !== 'string' || !text) return 0;
+  const seen = new Set(); const re = citationRegex(); let m;
+  while ((m = re.exec(text))) seen.add(`${m[1]}:${m[2]}`);
+  return seen.size;
+}
+module.exports = { CITATION_SOURCE, citationRegex, countReportCitations };