qvdjs 0.9.1 → 0.9.2

package/dist/index.js

@@ -1,5 +1,5 @@
+import fs from 'fs';
 import path from 'path';
-import fs2 from 'fs';
 import crypto from 'crypto';
 import xml2 from 'xml2js';
 import assert from 'assert';
@@ -250,8 +250,8 @@ var init_QvdSymbol = __esm({
     };
   }
 });
-function isWithinDirectory(resolvedBaseDir, resolvedPath) {
-  const isCaseInsensitiveFS = process.platform === "win32" || process.platform === "darwin";
+function isWithinDirectoryLexically(resolvedBaseDir, resolvedPath) {
+  const isCaseInsensitiveFS = process.platform === "win32";
   const base = isCaseInsensitiveFS ? resolvedBaseDir.toLowerCase() : resolvedBaseDir;
   const target = isCaseInsensitiveFS ? resolvedPath.toLowerCase() : resolvedPath;
   const relative = path.relative(base, target);
@@ -263,6 +263,55 @@ function isWithinDirectory(resolvedBaseDir, resolvedPath) {
   }
   return relative !== ".." && !relative.startsWith(`..${path.sep}`);
 }
+function resolveDeepestExisting(target) {
+  let current = target;
+  for (; ; ) {
+    try {
+      return fs.realpathSync(current);
+    } catch (error) {
+      const code = (
+        /** @type {{code?: string}} */
+        error?.code
+      );
+      if (code !== "ENOENT" && code !== "ENOTDIR") {
+        return null;
+      }
+      const parent = path.dirname(current);
+      if (parent === current) {
+        return null;
+      }
+      current = parent;
+    }
+  }
+}
+function isWithinDirectoryOnDisk(resolvedBaseDir, resolvedPath) {
+  let baseStat;
+  try {
+    baseStat = fs.statSync(fs.realpathSync(resolvedBaseDir));
+  } catch {
+    return null;
+  }
+  let current = resolveDeepestExisting(resolvedPath);
+  if (current === null) {
+    return null;
+  }
+  for (; ; ) {
+    let stat;
+    try {
+      stat = fs.statSync(current);
+    } catch {
+      return null;
+    }
+    if (stat.dev === baseStat.dev && stat.ino === baseStat.ino) {
+      return true;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return false;
+    }
+    current = parent;
+  }
+}
 function validatePath(filePath, allowedDir) {
   if (typeof filePath !== "string" || filePath.length === 0) {
     throw new QvdValidationError("filePath must be a non-empty string", {
@@ -285,12 +334,17 @@ function validatePath(filePath, allowedDir) {
   const resolvedPath = path.resolve(filePath);
   const baseDir = allowedDir || process.cwd();
   const resolvedBaseDir = path.resolve(baseDir);
-  if (!isWithinDirectory(resolvedBaseDir, resolvedPath)) {
+  const onDisk = isWithinDirectoryOnDisk(resolvedBaseDir, resolvedPath);
+  const contained = onDisk === null ? isWithinDirectoryLexically(resolvedBaseDir, resolvedPath) : onDisk;
+  if (!contained) {
     throw new QvdSecurityError("Path traversal detected: Access denied", {
       path: filePath,
       resolvedPath,
       allowedDir: resolvedBaseDir,
-      reason: "outside_allowed_directory"
+      reason: "outside_allowed_directory",
+      // Says which check refused, so a rejection of a path that looks contained is traceable to
+      // a symlink or a case difference rather than looking like a bug.
+      check: onDisk === null ? "lexical" : "filesystem"
     });
   }
   return resolvedPath;
@@ -319,7 +373,8 @@ var init_QvdFileWriter = __esm({
        * @param {QvdDataFrame} df The data frame to write to the QVD file.
        * @param {Object} [options={}] Options for the writer.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file
-       *   path must be within this directory. Defaults to the current working directory. To permit
+       *   path must be within this directory, with symlinks resolved first, so a link inside it that
+       *   points outside it is rejected. Defaults to the current working directory. To permit
        *   an entire volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or
        *   empty value falls back to the working directory rather than removing the restriction.
        * @param {Function} [options.onProgress] Optional progress callback function.
@@ -367,7 +422,7 @@ var init_QvdFileWriter = __esm({
         const headerBuffer = Buffer.concat([Buffer.from(this._header, "utf-8"), Buffer.from([0])]);
         let fd;
         try {
-          fd = await fs2.promises.open(this._path, "w");
+          fd = await fs.promises.open(this._path, "w");
           await fd.write(headerBuffer, 0, headerBuffer.length, 0);
           await fd.write(this._symbolBuffer, 0, this._symbolBuffer.length, headerBuffer.length);
           await fd.write(this._indexBuffer, 0, this._indexBuffer.length, headerBuffer.length + this._symbolBuffer.length);
@@ -1230,7 +1285,8 @@ var init_QvdFileReader = __esm({
        * @param {string} filePath The path to the QVD file to load.
        * @param {Object} [options={}] Options for the reader.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file
-       *   path must be within this directory. Defaults to the current working directory. To permit
+       *   path must be within this directory, with symlinks resolved first, so a link inside it that
+       *   points outside it is rejected. Defaults to the current working directory. To permit
        *   an entire volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or
        *   empty value falls back to the working directory rather than removing the restriction.
        * @param {number} [options.memorySafetyFactor=0.3] Memory safety factor (0.0-1.0). Determines
@@ -1279,13 +1335,13 @@ var init_QvdFileReader = __esm({
        */
       async _readData(maxRows = null) {
         if (maxRows === null) {
-          this._buffer = await fs2.promises.readFile(this._path);
+          this._buffer = await fs.promises.readFile(this._path);
           this._fileSize = this._buffer.length;
           return;
         }
         const HEADER_DELIMITER = "\r\n\0";
         const CHUNK_SIZE = 64 * 1024;
-        const stream = fs2.createReadStream(this._path, {
+        const stream = fs.createReadStream(this._path, {
           highWaterMark: CHUNK_SIZE
         });
         const headerChunks = [];
@@ -1368,7 +1424,7 @@ var init_QvdFileReader = __esm({
         }
         const indexTableBytesToRead = rowsToLoad * recordSize;
         const totalBytesToRead = indexTableOffset + indexTableBytesToRead;
-        const fd = await fs2.promises.open(this._path, "r");
+        const fd = await fs.promises.open(this._path, "r");
         try {
           const { size: fileSize } = await fd.stat();
           this._fileSize = fileSize;
@@ -2114,7 +2170,8 @@ var init_QvdDataFrame = __esm({
        * @param {string} path The path to the QVD file.
        * @param {Object} [options] Optional writing options.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file path
-       *   must be within this directory. Defaults to the current working directory. To permit an entire
+       *   must be within this directory, with symlinks resolved first, so a link inside it that points
+       *   outside it is rejected. Defaults to the current working directory. To permit an entire
        *   volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or empty value falls
        *   back to the working directory rather than removing the restriction.
        * @param {Function} [options.onProgress] Optional progress callback function that receives progress updates during write operations.
@@ -2135,7 +2192,8 @@ var init_QvdDataFrame = __esm({
        * @param {number|null} [options.maxRows] The maximum number of rows to load. Must be a non-negative
        *   integer; if not specified or null, all rows are loaded. Anything else throws a QvdValidationError.
        * @param {string} [options.allowedDir] Optional allowed directory path. If provided, the file path
-       *   must be within this directory. Defaults to the current working directory. To permit an entire
+       *   must be within this directory, with symlinks resolved first, so a link inside it that points
+       *   outside it is rejected. Defaults to the current working directory. To permit an entire
        *   volume, pass its root explicitly ('/' on POSIX, 'C:\\' on Windows); a null or empty value falls
        *   back to the working directory rather than removing the restriction.
        * @param {number} [options.memorySafetyFactor=0.3] Memory safety factor (0.0-1.0). Determines what percentage