rechrome 1.40.0 → 1.42.0

package/scoped-upload.js

@@ -214,13 +214,14 @@ async function readHostFile(path, hostDirs, limit) {
   const inside = (real) => roots.some((root) => real.startsWith(root.endsWith(sep) ? root : root + sep));
   const resolveInside = async () => {
     let real;
+    const refused = () => new Error("Host upload path is not an existing file in the listener's allowed directories");
     try {
       real = await realpath(path);
     } catch {
-      throw new Error("Host upload file not found");
+      throw refused();
     }
     if (!inside(real))
-      throw new Error("Host upload path is outside the listener's allowed directories");
+      throw refused();
     return real;
   };
   const handle = await open(await resolveInside(), fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
@@ -292,7 +293,7 @@ async function receiveUpload(options) {
     const failed = (r) => r.status !== 0 || /^### Error\b/m.test(r.stdout);
     const script = async (mode) => {
       const file = join(dir, randomBytes(8).toString("hex") + ".js");
-      await writeFile(file, uploadScript(mode, p.target, path, p), { mode: 384, flag: "wx" });
+      await writeFile(file, uploadScript(mode, p.target, path, { ...p, data: bytes.toString("base64") }), { mode: 384, flag: "wx" });
       return options.run(["run-code", "--filename", file]);
     };
     const mode = p.mode ?? "auto";

package/scoped-upload.ts

@@ -224,8 +224,10 @@ export async function readHostFile(path: string, hostDirs: string[] | undefined,
   const inside = (real: string) => roots.some(root => real.startsWith(root.endsWith(sep) ? root : root + sep));
   const resolveInside = async () => {
     let real: string;
-    try { real = await realpath(path); } catch { throw new Error('Host upload file not found'); }
-    if (!inside(real)) throw new Error('Host upload path is outside the listener\'s allowed directories');
+    // One answer for "missing" and "outside", so a link holder can't probe which host paths exist.
+    const refused = () => new Error('Host upload path is not an existing file in the listener\'s allowed directories');
+    try { real = await realpath(path); } catch { throw refused(); }
+    if (!inside(real)) throw refused();
     return real;
   };
   // Open once, then prove the opened file is the one an allowed path names now (same device and
@@ -293,7 +295,8 @@ export async function receiveUpload(options: {
     const failed = (r: UploadResult) => r.status !== 0 || /^### Error\b/m.test(r.stdout);
     const script = async (mode: Exclude<UploadMode, 'chooser'>) => {
       const file = join(dir!, randomBytes(8).toString('hex') + '.js');
-      await writeFile(file, uploadScript(mode, p.target, path, p), { mode: 0o600, flag: 'wx' });
+      // drop/paste embed the bytes in the page script; a --host upload sent none, so use what was read.
+      await writeFile(file, uploadScript(mode, p.target, path, { ...p, data: bytes.toString('base64') }), { mode: 0o600, flag: 'wx' });
       return options.run(['run-code', '--filename', file]);
     };
     const mode = p.mode ?? 'auto';

package/secret-rules/gitleaks.LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 Zachary Rice
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.