toolcraft-openapi 0.0.24 → 0.0.25

package/dist/bin/generate.d.ts

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
 interface GenerateCliFileSystem {
+    lstat(targetPath: string): Promise<{
+        isDirectory(): boolean;
+        isSymbolicLink(): boolean;
+    }>;
     mkdir(directoryPath: string, options?: {
         recursive?: boolean;
     }): Promise<unknown>;
@@ -9,9 +13,6 @@ interface GenerateCliFileSystem {
         force?: boolean;
     }): Promise<void>;
     realpath(targetPath: string): Promise<string>;
-    stat(targetPath: string): Promise<{
-        isDirectory(): boolean;
-    }>;
     writeFile(filePath: string, contents: string, encoding: BufferEncoding): Promise<void>;
 }
 interface GenerateCliWriter {

package/dist/bin/generate.js

@@ -81,7 +81,7 @@ export async function syncGeneratedClient(options, services) {
     if (!options.check && drifted) {
         try {
             await writeGeneratedFiles(services.fs, outputDir, updatedFiles);
-            await deleteGeneratedFiles(services.fs, deletedFiles);
+            await deleteGeneratedFiles(services.fs, outputDir, deletedFiles);
         }
         catch (error) {
             await restoreGeneratedFiles(services.fs, outputDir, currentFiles, updatedFiles, deletedFiles);
@@ -170,10 +170,17 @@ function tryParseUrl(input) {
 async function readGeneratedFiles(fs, directoryPath) {
     const files = new Map();
     try {
+        const directoryStats = await fs.lstat(directoryPath);
+        if (directoryStats.isSymbolicLink()) {
+            throw new Error("Generated output must remain inside the output directory.");
+        }
         const entries = await fs.readdir(directoryPath);
         for (const entry of entries) {
             const entryPath = path.resolve(directoryPath, entry);
-            const stats = await fs.stat(entryPath);
+            const stats = await fs.lstat(entryPath);
+            if (stats.isSymbolicLink()) {
+                throw new Error("Generated output must remain inside the output directory.");
+            }
             if (stats.isDirectory()) {
                 for (const [nestedPath, nestedContents] of await readGeneratedFiles(fs, entryPath)) {
                     files.set(nestedPath, nestedContents);
@@ -228,8 +235,9 @@ async function assertSafeOutputPath(fs, outputDir, filePath) {
         throw new Error("Generated output must remain inside the output directory.");
     }
 }
-async function deleteGeneratedFiles(fs, filePaths) {
+async function deleteGeneratedFiles(fs, outputDir, filePaths) {
     for (const filePath of filePaths) {
+        await assertSafeOutputPath(fs, outputDir, filePath);
         await fs.rm(filePath, { force: true });
     }
 }
@@ -237,6 +245,7 @@ async function restoreGeneratedFiles(fs, outputDir, currentFiles, updatedFiles,
     for (const file of updatedFiles) {
         const previousContents = currentFiles.get(file.path);
         if (previousContents === undefined) {
+            await assertSafeOutputPath(fs, outputDir, file.path);
             await fs.rm(file.path, { force: true });
             continue;
         }

package/node_modules/auth-store/dist/encrypted-file-store.d.ts

@@ -33,6 +33,7 @@ export interface EncryptedFileStoreInput {
 export declare class EncryptedFileStore implements SecretStore {
     private readonly fs;
     private readonly filePath;
+    private readonly symbolicLinkCheckStartPath;
     private readonly salt;
     private readonly getMachineIdentity;
     private readonly getRandomBytes;

package/node_modules/auth-store/dist/encrypted-file-store.js

@@ -13,6 +13,7 @@ let temporaryFileSequence = 0;
 export class EncryptedFileStore {
     fs;
     filePath;
+    symbolicLinkCheckStartPath;
     salt;
     getMachineIdentity;
     getRandomBytes;
@@ -20,7 +21,16 @@ export class EncryptedFileStore {
     constructor(input) {
         this.fs = input.fs ?? fs;
         this.salt = input.salt;
-        this.filePath = input.filePath ?? path.join((input.getHomeDirectory ?? homedir)(), input.defaultDirectory ?? ".auth-store", input.defaultFileName ?? "credentials.enc");
+        if (input.filePath === undefined) {
+            const homeDirectory = (input.getHomeDirectory ?? homedir)();
+            const defaultDirectory = input.defaultDirectory ?? ".auth-store";
+            this.filePath = path.join(homeDirectory, defaultDirectory, input.defaultFileName ?? "credentials.enc");
+            this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory);
+        }
+        else {
+            this.filePath = input.filePath;
+            this.symbolicLinkCheckStartPath = null;
+        }
         this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
         this.getRandomBytes = input.getRandomBytes ?? randomBytes;
     }
@@ -106,7 +116,7 @@ export class EncryptedFileStore {
     }
     async assertRegularCredentialPath() {
         const resolvedPath = path.resolve(this.filePath);
-        const protectedPaths = [path.dirname(resolvedPath), resolvedPath];
+        const protectedPaths = getProtectedCredentialPaths(resolvedPath, this.symbolicLinkCheckStartPath);
         for (const currentPath of protectedPaths) {
             try {
                 const stats = await this.fs.lstat(currentPath);
@@ -135,6 +145,30 @@ export class EncryptedFileStore {
         return this.keyPromise;
     }
 }
+function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
+    const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
+    return path.resolve(homeDirectory, firstSegment ?? ".");
+}
+function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
+    if (symbolicLinkCheckStartPath === null) {
+        return [path.dirname(resolvedPath), resolvedPath];
+    }
+    const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
+    if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
+        return [path.dirname(resolvedPath), resolvedPath];
+    }
+    const protectedPaths = [resolvedStartPath];
+    let currentPath = resolvedStartPath;
+    for (const segment of path.relative(resolvedStartPath, resolvedPath).split(path.sep).filter(Boolean)) {
+        currentPath = path.join(currentPath, segment);
+        protectedPaths.push(currentPath);
+    }
+    return protectedPaths;
+}
+function isPathInsideOrEqual(childPath, parentPath) {
+    const relativePath = path.relative(parentPath, childPath);
+    return relativePath === "" || (!relativePath.startsWith("..") && !path.isAbsolute(relativePath));
+}
 async function removeIfPresent(fileSystem, filePath) {
     try {
         await fileSystem.unlink(filePath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-openapi",
-  "version": "0.0.24",
+  "version": "0.0.25",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,7 +31,7 @@
     "@clack/core": "^1.0.0",
     "@clack/prompts": "^1.0.0",
     "@poe-code/design-system": "^0.0.2",
-    "toolcraft": "0.0.24",
+    "toolcraft": "0.0.25",
     "auth-store": "^0.0.1",
     "yaml": "^2.8.2"
   },