just-bash 2.10.2 → 2.10.4

package/dist/fs/overlay-fs/overlay-fs.d.ts

@@ -32,12 +32,19 @@ export interface OverlayFsOptions {
 }
 export declare class OverlayFs implements IFileSystem {
     private readonly root;
+    private readonly canonicalRoot;
     private readonly mountPoint;
     private readonly readOnly;
     private readonly maxFileReadSize;
     private readonly memory;
     private readonly deleted;
     constructor(options: OverlayFsOptions);
+    /**
+     * Validate that a real filesystem path stays within the sandbox root
+     * after resolving all OS-level symlinks (including in parent components).
+     * Returns false if the path escapes the sandbox.
+     */
+    private validateRealPath;
     /**
      * Throws an error if the filesystem is in read-only mode.
      */
@@ -87,6 +94,12 @@ export declare class OverlayFs implements IFileSystem {
     stat(path: string, seen?: Set<string>): Promise<FsStat>;
     lstat(path: string): Promise<FsStat>;
     private resolveSymlink;
+    /**
+     * Convert a real-fs symlink target to a virtual target suitable for resolveSymlink.
+     * Handles absolute real-fs paths that point within the root by converting them
+     * to virtual paths relative to the mount point.
+     */
+    private realTargetToVirtual;
     mkdir(path: string, options?: MkdirOptions): Promise<void>;
     /**
      * Core readdir implementation that returns entries with file types.

package/dist/fs/read-write-fs/read-write-fs.d.ts

@@ -24,8 +24,20 @@ export interface ReadWriteFsOptions {
 }
 export declare class ReadWriteFs implements IFileSystem {
     private readonly root;
+    private readonly canonicalRoot;
     private readonly maxFileReadSize;
     constructor(options: ReadWriteFsOptions);
+    /**
+     * Validate that a resolved real path stays within the sandbox root.
+     * Resolves all symlinks to detect escape attempts via OS-level symlinks.
+     * Throws EACCES if the path escapes the root.
+     */
+    private resolveAndValidate;
+    /**
+     * Validate the parent directory of a path (for operations like lstat/readlink
+     * that should not follow the final component's symlink).
+     */
+    private validateParent;
     /**
      * Convert a virtual path to a real filesystem path.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "just-bash",
-  "version": "2.10.2",
+  "version": "2.10.4",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",