isomorphic-git 1.38.6 → 1.38.8

package/managers/index.cjs

@@ -4919,13 +4919,19 @@ function parseBuffer(buffer) {
     // "." and ".." (which resolve outside the working directory), and ".git" (which git
     // disallows as a path component). Checks mirror git's is_ntfs_dotgit() and
     // is_hfs_dotgit(): case-insensitive, trailing dots/spaces stripped (NTFS),
-    // NTFS 8.3 short name aliases (git~1..git~9), and HFS+ ignorable Unicode
-    // characters stripped (zero-width joiners, directional marks, BOM, etc.).
+    // NTFS 8.3 short name aliases (git~1..git~9), NTFS Alternate Data Streams, and
+    // HFS+ ignorable Unicode characters stripped (zero-width joiners, directional
+    // marks, BOM, etc.).
     const hfsClean = path.replace(
       /[\u200C-\u200F\u202A-\u202E\u206A-\u206F\uFEFF]/g,
       ''
     );
-    const normalized = hfsClean.toLowerCase().replace(/[. ]+$/, '');
+    // NTFS Alternate Data Streams are referenced as `<name>:<stream>:<type>`, and a
+    // directory's default stream lets `.git::$INDEX_ALLOCATION` resolve to the `.git`
+    // directory itself. git forbids *any* ADS, so only the portion before the first
+    // colon names the actual entry we normalize and check.
+    const ntfsClean = hfsClean.split(':')[0];
+    const normalized = ntfsClean.toLowerCase().replace(/[. ]+$/, '');
     if (
       path.includes('\\') ||
       path.includes('/') ||
@@ -5862,6 +5868,31 @@ async function _writeTree({ fs, gitdir, tree }) {
   return oid
 }
 
+/**
+ * Refuse to materialize a working-tree entry whose parent path traverses a
+ * symbolic link. A leading component that is a symlink could otherwise redirect
+ * a write or mkdir outside the working tree. git applies the same check: it does
+ * not follow symlinks in the leading path when writing working-tree files.
+ *
+ * @param {import('../models/FileSystem.js').FileSystem} fs
+ * @param {string} dir
+ * @param {string} fullpath
+ */
+async function assertNoSymlinkInLeadingPath(fs, dir, fullpath) {
+  const parts = fullpath.split('/');
+  parts.pop(); // the final segment is the entry being written, not a leading dir
+  let current = dir;
+  for (const part of parts) {
+    if (part === '' || part === '.') continue
+    current = `${current}/${part}`;
+    const stats = await fs.lstat(current);
+    // lstat returns null when the path doesn't exist yet (nothing to traverse).
+    if (stats && stats.isSymbolicLink()) {
+      throw new UnsafeFilepathError(fullpath)
+    }
+  }
+}
+
 function posixifyPathBuffer(buffer) {
   let idx;
   while (~(idx = buffer.indexOf(92))) buffer[idx] = 47;
@@ -6118,6 +6149,11 @@ async function applyTreeChanges({
           await fs.rmdir(currentFilepath);
           break
         case 'mkdir':
+          // Don't mkdir through a symlinked leading path: a parent component that
+          // is a symlink could otherwise redirect the directory creation outside
+          // the working tree. git applies the same check (it does not follow
+          // symlinks here) — see checkout.
+          await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
           await fs.mkdir(currentFilepath);
           break
         case 'rm':
@@ -6130,6 +6166,10 @@ async function applyTreeChanges({
               currentFilepath.startsWith(removedDir)
             )
           ) {
+            // Don't write through a symlinked leading path (see checkout): a
+            // parent component that is a symlink could redirect the write to a
+            // location outside the working tree.
+            await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
             const { object } = await _readObject({
               fs,
               cache: {},

package/managers/index.js

@@ -4906,13 +4906,19 @@ function parseBuffer(buffer) {
     // "." and ".." (which resolve outside the working directory), and ".git" (which git
     // disallows as a path component). Checks mirror git's is_ntfs_dotgit() and
     // is_hfs_dotgit(): case-insensitive, trailing dots/spaces stripped (NTFS),
-    // NTFS 8.3 short name aliases (git~1..git~9), and HFS+ ignorable Unicode
-    // characters stripped (zero-width joiners, directional marks, BOM, etc.).
+    // NTFS 8.3 short name aliases (git~1..git~9), NTFS Alternate Data Streams, and
+    // HFS+ ignorable Unicode characters stripped (zero-width joiners, directional
+    // marks, BOM, etc.).
     const hfsClean = path.replace(
       /[\u200C-\u200F\u202A-\u202E\u206A-\u206F\uFEFF]/g,
       ''
     );
-    const normalized = hfsClean.toLowerCase().replace(/[. ]+$/, '');
+    // NTFS Alternate Data Streams are referenced as `<name>:<stream>:<type>`, and a
+    // directory's default stream lets `.git::$INDEX_ALLOCATION` resolve to the `.git`
+    // directory itself. git forbids *any* ADS, so only the portion before the first
+    // colon names the actual entry we normalize and check.
+    const ntfsClean = hfsClean.split(':')[0];
+    const normalized = ntfsClean.toLowerCase().replace(/[. ]+$/, '');
     if (
       path.includes('\\') ||
       path.includes('/') ||
@@ -5849,6 +5855,31 @@ async function _writeTree({ fs, gitdir, tree }) {
   return oid
 }
 
+/**
+ * Refuse to materialize a working-tree entry whose parent path traverses a
+ * symbolic link. A leading component that is a symlink could otherwise redirect
+ * a write or mkdir outside the working tree. git applies the same check: it does
+ * not follow symlinks in the leading path when writing working-tree files.
+ *
+ * @param {import('../models/FileSystem.js').FileSystem} fs
+ * @param {string} dir
+ * @param {string} fullpath
+ */
+async function assertNoSymlinkInLeadingPath(fs, dir, fullpath) {
+  const parts = fullpath.split('/');
+  parts.pop(); // the final segment is the entry being written, not a leading dir
+  let current = dir;
+  for (const part of parts) {
+    if (part === '' || part === '.') continue
+    current = `${current}/${part}`;
+    const stats = await fs.lstat(current);
+    // lstat returns null when the path doesn't exist yet (nothing to traverse).
+    if (stats && stats.isSymbolicLink()) {
+      throw new UnsafeFilepathError(fullpath)
+    }
+  }
+}
+
 function posixifyPathBuffer(buffer) {
   let idx;
   while (~(idx = buffer.indexOf(92))) buffer[idx] = 47;
@@ -6105,6 +6136,11 @@ async function applyTreeChanges({
           await fs.rmdir(currentFilepath);
           break
         case 'mkdir':
+          // Don't mkdir through a symlinked leading path: a parent component that
+          // is a symlink could otherwise redirect the directory creation outside
+          // the working tree. git applies the same check (it does not follow
+          // symlinks here) — see checkout.
+          await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
           await fs.mkdir(currentFilepath);
           break
         case 'rm':
@@ -6117,6 +6153,10 @@ async function applyTreeChanges({
               currentFilepath.startsWith(removedDir)
             )
           ) {
+            // Don't write through a symlinked leading path (see checkout): a
+            // parent component that is a symlink could redirect the write to a
+            // location outside the working tree.
+            await assertNoSymlinkInLeadingPath(fs, dir, op.filepath);
             const { object } = await _readObject({
               fs,
               cache: {},