qvdjs 0.9.1 → 0.9.2

package/dist/index.cjs

@@ -1,7 +1,7 @@
 'use strict';
 
+var fs = require('fs');
 var path = require('path');
-var fs2 = require('fs');
 var crypto = require('crypto');
 var xml2 = require('xml2js');
 var assert = require('assert');
@@ -10,8 +10,8 @@ var v8 = require('v8');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
+var fs__default = /*#__PURE__*/_interopDefault(fs);
 var path__default = /*#__PURE__*/_interopDefault(path);
-var fs2__default = /*#__PURE__*/_interopDefault(fs2);
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 var xml2__default = /*#__PURE__*/_interopDefault(xml2);
 var assert__default = /*#__PURE__*/_interopDefault(assert);
@@ -262,8 +262,8 @@ var init_QvdSymbol = __esm({
     };
   }
 });
-function isWithinDirectory(resolvedBaseDir, resolvedPath) {
-  const isCaseInsensitiveFS = process.platform === "win32" || process.platform === "darwin";
+function isWithinDirectoryLexically(resolvedBaseDir, resolvedPath) {
+  const isCaseInsensitiveFS = process.platform === "win32";
   const base = isCaseInsensitiveFS ? resolvedBaseDir.toLowerCase() : resolvedBaseDir;
   const target = isCaseInsensitiveFS ? resolvedPath.toLowerCase() : resolvedPath;
   const relative = path__default.default.relative(base, target);
@@ -275,6 +275,55 @@ function isWithinDirectory(resolvedBaseDir, resolvedPath) {
   }
   return relative !== ".." && !relative.startsWith(`..${path__default.default.sep}`);
 }
+function resolveDeepestExisting(target) {
+  let current = target;
+  for (; ; ) {
+    try {
+      return fs__default.default.realpathSync(current);
+    } catch (error) {
+      const code = (
+        /** @type {{code?: string}} */
+        error?.code
+      );
+      if (code !== "ENOENT" && code !== "ENOTDIR") {
+        return null;
+      }
+      const parent = path__default.default.dirname(current);
+      if (parent === current) {
+        return null;
+      }
+      current = parent;
+    }
+  }
+}
+function isWithinDirectoryOnDisk(resolvedBaseDir, resolvedPath) {
+  let baseStat;
+  try {
+    baseStat = fs__default.default.statSync(fs__default.default.realpathSync(resolvedBaseDir));
+  } catch {
+    return null;
+  }
+  let current = resolveDeepestExisting(resolvedPath);
+  if (current === null) {
+    return null;
+  }
+  for (; ; ) {
+    let stat;
+    try {
+      stat = fs__default.default.statSync(current);
+    } catch {
+      return null;
+    }
+    if (stat.dev === baseStat.dev && stat.ino === baseStat.ino) {
+      return true;
+    }
+    const parent = path__default.default.dirname(current);
+    if (parent === current) {
+      return false;
+    }
+    current = parent;
+  }
+}
 function validatePath(filePath, allowedDir) {
   if (typeof filePath !== "string" || filePath.length === 0) {
     throw new exports.QvdValidationError("filePath must be a non-empty string", {
@@ -297,12 +346,17 @@ function validatePath(filePath, allowedDir) {
   const resolvedPath = path__default.default.resolve(filePath);
   const baseDir = allowedDir || process.cwd();
   const resolvedBaseDir = path__default.default.resolve(baseDir);
-  if (!isWithinDirectory(resolvedBaseDir, resolvedPath)) {
+  const onDisk = isWithinDirectoryOnDisk(resolvedBaseDir, resolvedPath);
+  const contained = onDisk === null ? isWithinDirectoryLexically(resolvedBaseDir, resolvedPath) : onDisk;
+  if (!contained) {
     throw new exports.QvdSecurityError("Path traversal detected: Access denied", {
       path: filePath,
       resolvedPath,
       allowedDir: resolvedBaseDir,
-      reason: "outside_allowed_directory"
+      reason: "outside_allowed_directory",
+      // Says which check refused, so a rejection of a path that looks contained is traceable to
+      // a symlink or a case difference rather than looking like a bug.
+      check: onDisk === null ? "lexical" : "filesystem"
     });
   }
   return resolvedPath;
@@ -331,7 +385,8 @@ var init_QvdFileWriter = __esm({
        * @param {QvdDataFrame} df The data frame to write to the QVD file.
        * @param {Object} [options={}] Options for the writer.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file
-       *   path must be within this directory. Defaults to the current working directory. To permit
+       *   path must be within this directory, with symlinks resolved first, so a link inside it that
+       *   points outside it is rejected. Defaults to the current working directory. To permit
        *   an entire volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or
        *   empty value falls back to the working directory rather than removing the restriction.
        * @param {Function} [options.onProgress] Optional progress callback function.
@@ -379,7 +434,7 @@ var init_QvdFileWriter = __esm({
         const headerBuffer = Buffer.concat([Buffer.from(this._header, "utf-8"), Buffer.from([0])]);
         let fd;
         try {
-          fd = await fs2__default.default.promises.open(this._path, "w");
+          fd = await fs__default.default.promises.open(this._path, "w");
           await fd.write(headerBuffer, 0, headerBuffer.length, 0);
           await fd.write(this._symbolBuffer, 0, this._symbolBuffer.length, headerBuffer.length);
           await fd.write(this._indexBuffer, 0, this._indexBuffer.length, headerBuffer.length + this._symbolBuffer.length);
@@ -1242,7 +1297,8 @@ var init_QvdFileReader = __esm({
        * @param {string} filePath The path to the QVD file to load.
        * @param {Object} [options={}] Options for the reader.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file
-       *   path must be within this directory. Defaults to the current working directory. To permit
+       *   path must be within this directory, with symlinks resolved first, so a link inside it that
+       *   points outside it is rejected. Defaults to the current working directory. To permit
        *   an entire volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or
        *   empty value falls back to the working directory rather than removing the restriction.
        * @param {number} [options.memorySafetyFactor=0.3] Memory safety factor (0.0-1.0). Determines
@@ -1291,13 +1347,13 @@ var init_QvdFileReader = __esm({
        */
       async _readData(maxRows = null) {
         if (maxRows === null) {
-          this._buffer = await fs2__default.default.promises.readFile(this._path);
+          this._buffer = await fs__default.default.promises.readFile(this._path);
           this._fileSize = this._buffer.length;
           return;
         }
         const HEADER_DELIMITER = "\r\n\0";
         const CHUNK_SIZE = 64 * 1024;
-        const stream = fs2__default.default.createReadStream(this._path, {
+        const stream = fs__default.default.createReadStream(this._path, {
           highWaterMark: CHUNK_SIZE
         });
         const headerChunks = [];
@@ -1380,7 +1436,7 @@ var init_QvdFileReader = __esm({
         }
         const indexTableBytesToRead = rowsToLoad * recordSize;
         const totalBytesToRead = indexTableOffset + indexTableBytesToRead;
-        const fd = await fs2__default.default.promises.open(this._path, "r");
+        const fd = await fs__default.default.promises.open(this._path, "r");
         try {
           const { size: fileSize } = await fd.stat();
           this._fileSize = fileSize;
@@ -2126,7 +2182,8 @@ var init_QvdDataFrame = __esm({
        * @param {string} path The path to the QVD file.
        * @param {Object} [options] Optional writing options.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file path
-       *   must be within this directory. Defaults to the current working directory. To permit an entire
+       *   must be within this directory, with symlinks resolved first, so a link inside it that points
+       *   outside it is rejected. Defaults to the current working directory. To permit an entire
        *   volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or empty value falls
        *   back to the working directory rather than removing the restriction.
        * @param {Function} [options.onProgress] Optional progress callback function that receives progress updates during write operations.
@@ -2147,7 +2204,8 @@ var init_QvdDataFrame = __esm({
        * @param {number|null} [options.maxRows] The maximum number of rows to load. Must be a non-negative
        *   integer; if not specified or null, all rows are loaded. Anything else throws a QvdValidationError.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file path
-       *   must be within this directory. Defaults to the current working directory. To permit an entire
+       *   must be within this directory, with symlinks resolved first, so a link inside it that points
+       *   outside it is rejected. Defaults to the current working directory. To permit an entire
        *   volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or empty value falls
        *   back to the working directory rather than removing the restriction.
        * @param {number} [options.memorySafetyFactor=0.3] Memory safety factor (0.0-1.0). Determines what percentage