secure-file-check 1.0.0 → 1.0.1

package/bin/cli.js

@@ -42,17 +42,51 @@ function isIgnored(filePath) {
 
 async function walkDir(dir) {
   const results = [];
-  const list = await fs.readdir(dir, { withFileTypes: true });
+  const stack = [dir];
+  const seen = new Set();
 
-  for (const f of list) {
-    const fullPath = path.join(dir, f.name);
+  while (stack.length) {
+    const current = stack.pop();
 
-    if (isIgnored(fullPath)) continue;
+    let realCurrent;
+    try {
+      realCurrent = await fs.realpath(current);
+    } catch (e) {
+      realCurrent = current;
+    }
 
-    if (f.isDirectory()) {
-      results.push(...(await walkDir(fullPath)));
-    } else {
-      results.push(fullPath);
+    if (seen.has(realCurrent)) continue;
+    seen.add(realCurrent);
+
+    let list;
+    try {
+      list = await fs.readdir(current, { withFileTypes: true });
+    } catch (e) {
+      // permission denied or not a directory -> skip
+      continue;
+    }
+
+    for (const f of list) {
+      const fullPath = path.join(current, f.name);
+
+      if (isIgnored(fullPath)) continue;
+
+      if (f.isDirectory()) {
+        stack.push(fullPath);
+      } else if (f.isSymbolicLink()) {
+        // resolve symlink target and only traverse directories to avoid cycles
+        try {
+          const targetReal = await fs.realpath(fullPath);
+          const stat = await fs.stat(targetReal);
+          if (stat.isDirectory()) stack.push(targetReal);
+          else results.push(fullPath);
+        } catch (e) {
+          // broken symlink or permission issue -> skip
+          continue;
+        }
+      } else {
+        results.push(fullPath);
+      }
     }
   }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "secure-file-check",
   "description": "CLI + API for validating file types and detecting suspicious Office documents (VBA/macro detection).",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "main": "./src/validator.js",
   "scripts": {