isomorphic-git 1.38.6 → 1.38.8

package/index.cjs

@@ -2541,13 +2541,19 @@ function parseBuffer(buffer) {
     // "." and ".." (which resolve outside the working directory), and ".git" (which git
     // disallows as a path component). Checks mirror git's is_ntfs_dotgit() and
     // is_hfs_dotgit(): case-insensitive, trailing dots/spaces stripped (NTFS),
-    // NTFS 8.3 short name aliases (git~1..git~9), and HFS+ ignorable Unicode
-    // characters stripped (zero-width joiners, directional marks, BOM, etc.).
+    // NTFS 8.3 short name aliases (git~1..git~9), NTFS Alternate Data Streams, and
+    // HFS+ ignorable Unicode characters stripped (zero-width joiners, directional
+    // marks, BOM, etc.).
     const hfsClean = path.replace(
       /[\u200C-\u200F\u202A-\u202E\u206A-\u206F\uFEFF]/g,
       ''
     );
-    const normalized = hfsClean.toLowerCase().replace(/[. ]+$/, '');
+    // NTFS Alternate Data Streams are referenced as `<name>:<stream>:<type>`, and a
+    // directory's default stream lets `.git::$INDEX_ALLOCATION` resolve to the `.git`
+    // directory itself. git forbids *any* ADS, so only the portion before the first
+    // colon names the actual entry we normalize and check.
+    const ntfsClean = hfsClean.split(':')[0];
+    const normalized = ntfsClean.toLowerCase().replace(/[. ]+$/, '');
     if (
       path.includes('\\') ||
       path.includes('/') ||
@@ -6884,23 +6890,11 @@ async function branch({
   }
 }
 
-const worthWalking = (filepath, root) => {
-  if (filepath === '.' || root == null || root.length === 0 || root === '.') {
-    return true
-  }
-  if (root.length >= filepath.length) {
-    return root.startsWith(filepath)
-  } else {
-    return filepath.startsWith(root)
-  }
-};
-
-// @ts-check
-
 /**
- * Throw if any leading directory component of `fullpath` (relative to `dir`) is a symbolic
- * link. git does not follow symlinks in the leading path when writing working-tree files;
- * matching that avoids writing through a symlinked parent into a location outside `dir`.
+ * Refuse to materialize a working-tree entry whose parent path traverses a
+ * symbolic link. A leading component that is a symlink could otherwise redirect
+ * a write or mkdir outside the working tree. git applies the same check: it does
+ * not follow symlinks in the leading path when writing working-tree files.
  *
  * @param {import('../models/FileSystem.js').FileSystem} fs
  * @param {string} dir
@@ -6921,6 +6915,19 @@ async function assertNoSymlinkInLeadingPath(fs, dir, fullpath) {
   }
 }
 
+const worthWalking = (filepath, root) => {
+  if (filepath === '.' || root == null || root.length === 0 || root === '.') {
+    return true
+  }
+  if (root.length >= filepath.length) {
+    return root.startsWith(filepath)
+  } else {
+    return filepath.startsWith(root)
+  }
+};
+
+// @ts-check
+
 /**
  * @param {object} args
  * @param {import('../models/FileSystem.js').FileSystem} args.fs
@@ -8462,6 +8469,11 @@ async function applyTreeChanges({
           await fs.rmdir(currentFilepath);
           break
         case 'mkdir':
+          // Don't mkdir through a symlinked leading path: a parent component that
+          // is a symlink could otherwise redirect the directory creation outside
+          // the working tree. git applies the same check (it does not follow
+          // symlinks here) — see checkout.
+          await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
           await fs.mkdir(currentFilepath);
           break
         case 'rm':
@@ -8474,6 +8486,10 @@ async function applyTreeChanges({
               currentFilepath.startsWith(removedDir)
             )
           ) {
+            // Don't write through a symlinked leading path (see checkout): a
+            // parent component that is a symlink could redirect the write to a
+            // location outside the working tree.
+            await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
             const { object } = await _readObject({
               fs,
               cache: {},
@@ -9482,8 +9498,8 @@ function filterCapabilities(server, client) {
 
 const pkg = {
   name: 'isomorphic-git',
-  version: '1.38.6',
-  agent: 'git/isomorphic-git@1.38.6',
+  version: '1.38.8',
+  agent: 'git/isomorphic-git@1.38.8',
 };
 
 class FIFO {

package/index.js

@@ -2534,13 +2534,19 @@ function parseBuffer(buffer) {
     // "." and ".." (which resolve outside the working directory), and ".git" (which git
     // disallows as a path component). Checks mirror git's is_ntfs_dotgit() and
     // is_hfs_dotgit(): case-insensitive, trailing dots/spaces stripped (NTFS),
-    // NTFS 8.3 short name aliases (git~1..git~9), and HFS+ ignorable Unicode
-    // characters stripped (zero-width joiners, directional marks, BOM, etc.).
+    // NTFS 8.3 short name aliases (git~1..git~9), NTFS Alternate Data Streams, and
+    // HFS+ ignorable Unicode characters stripped (zero-width joiners, directional
+    // marks, BOM, etc.).
     const hfsClean = path.replace(
       /[\u200C-\u200F\u202A-\u202E\u206A-\u206F\uFEFF]/g,
       ''
     );
-    const normalized = hfsClean.toLowerCase().replace(/[. ]+$/, '');
+    // NTFS Alternate Data Streams are referenced as `<name>:<stream>:<type>`, and a
+    // directory's default stream lets `.git::$INDEX_ALLOCATION` resolve to the `.git`
+    // directory itself. git forbids *any* ADS, so only the portion before the first
+    // colon names the actual entry we normalize and check.
+    const ntfsClean = hfsClean.split(':')[0];
+    const normalized = ntfsClean.toLowerCase().replace(/[. ]+$/, '');
     if (
       path.includes('\\') ||
       path.includes('/') ||
@@ -6871,23 +6877,11 @@ async function branch({
   }
 }
 
-const worthWalking = (filepath, root) => {
-  if (filepath === '.' || root == null || root.length === 0 || root === '.') {
-    return true
-  }
-  if (root.length >= filepath.length) {
-    return root.startsWith(filepath)
-  } else {
-    return filepath.startsWith(root)
-  }
-};
-
-// @ts-check
-
 /**
- * Throw if any leading directory component of `fullpath` (relative to `dir`) is a symbolic
- * link. git does not follow symlinks in the leading path when writing working-tree files;
- * matching that avoids writing through a symlinked parent into a location outside `dir`.
+ * Refuse to materialize a working-tree entry whose parent path traverses a
+ * symbolic link. A leading component that is a symlink could otherwise redirect
+ * a write or mkdir outside the working tree. git applies the same check: it does
+ * not follow symlinks in the leading path when writing working-tree files.
  *
  * @param {import('../models/FileSystem.js').FileSystem} fs
  * @param {string} dir
@@ -6908,6 +6902,19 @@ async function assertNoSymlinkInLeadingPath(fs, dir, fullpath) {
   }
 }
 
+const worthWalking = (filepath, root) => {
+  if (filepath === '.' || root == null || root.length === 0 || root === '.') {
+    return true
+  }
+  if (root.length >= filepath.length) {
+    return root.startsWith(filepath)
+  } else {
+    return filepath.startsWith(root)
+  }
+};
+
+// @ts-check
+
 /**
  * @param {object} args
  * @param {import('../models/FileSystem.js').FileSystem} args.fs
@@ -8449,6 +8456,11 @@ async function applyTreeChanges({
           await fs.rmdir(currentFilepath);
           break
         case 'mkdir':
+          // Don't mkdir through a symlinked leading path: a parent component that
+          // is a symlink could otherwise redirect the directory creation outside
+          // the working tree. git applies the same check (it does not follow
+          // symlinks here) — see checkout.
+          await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
           await fs.mkdir(currentFilepath);
           break
         case 'rm':
@@ -8461,6 +8473,10 @@ async function applyTreeChanges({
               currentFilepath.startsWith(removedDir)
             )
           ) {
+            // Don't write through a symlinked leading path (see checkout): a
+            // parent component that is a symlink could redirect the write to a
+            // location outside the working tree.
+            await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
             const { object } = await _readObject({
               fs,
               cache: {},
@@ -9469,8 +9485,8 @@ function filterCapabilities(server, client) {
 
 const pkg = {
   name: 'isomorphic-git',
-  version: '1.38.6',
-  agent: 'git/isomorphic-git@1.38.6',
+  version: '1.38.8',
+  agent: 'git/isomorphic-git@1.38.8',
 };
 
 class FIFO {