wyvrnpm 2.4.1 → 2.8.1

package/src/upload-built.js

@@ -7,6 +7,7 @@ const path = require('path');
 const { getProvider }        = require('./providers');
 const { defaultCompatBlock } = require('./compat');
 const { getBuildPaths }      = require('./build/cache');
+const { resolveSourceAuth }  = require('./auth');
 const log                    = require('./logger');
 
 const WYVRNPM_VERSION = require('../package.json').version;
@@ -193,6 +194,7 @@ function resolveUploadDestination(argv, config) {
   let src = argv.uploadSource;
   let awsProfile = argv.awsProfile;
   let token      = argv.token;
+  let sourceEntry = null;
 
   const publishSources = config.publishSources ?? [];
 
@@ -202,17 +204,24 @@ function resolveUploadDestination(argv, config) {
     if (named) {
       src        = named.url;
       awsProfile = awsProfile ?? named.profile;
-      token      = token      ?? named.token;
+      sourceEntry = named;
       log.info(`upload-built: using publish source "${named.name}" from config`);
     }
   } else if (publishSources.length > 0) {
     const first = publishSources[0];
     src        = first.url;
     awsProfile = awsProfile ?? first.profile;
-    token      = token      ?? first.token;
+    sourceEntry = first;
     log.info(`upload-built: using first configured publish source "${first.name}"`);
   }
 
+  // Fall back to the matched source entry's own token / tokenEnv only if
+  // the caller didn't pass one already (argv.token wins). resolveSourceAuth
+  // handles the literal-vs-env-backed precedence per side.
+  if (token === undefined || token === null) {
+    token = resolveSourceAuth({}, sourceEntry).token;
+  }
+
   if (!src) return null;
   return { uploadSource: src, uploadAuth: { awsProfile, token } };
 }

package/src/zip-safe.js

@@ -0,0 +1,52 @@
+'use strict';
+
+/**
+ * Defense-in-depth against Zip Slip (CVE-2018-1002200 family). Both
+ * node-stream-zip and adm-zip claim to handle this upstream, but we
+ * don't want to take the library's word for it on a supply-chain-
+ * critical code path. Pre-scan zip entry names before extraction and
+ * reject anything that could write outside the target directory.
+ *
+ * The ZIP spec uses forward slashes only, but Windows-produced archives
+ * sometimes leak backslashes — normalise both.
+ *
+ * @param {string} entryName   zip-internal path as reported by the zip library
+ * @param {string} [context]   optional archive identifier for the error message
+ * @throws {Error} if the entry name is absolute, contains a path-traversal
+ *                 segment, or starts with a Windows drive-letter prefix.
+ */
+function assertSafeZipEntryName(entryName, context) {
+  const where = context ? ` in ${context}` : '';
+
+  if (/^[A-Za-z]:[\\/]/.test(entryName)) {
+    throw new Error(`unsafe zip entry${where}: drive-letter absolute path ${JSON.stringify(entryName)}`);
+  }
+  if (entryName.startsWith('/') || entryName.startsWith('\\')) {
+    throw new Error(`unsafe zip entry${where}: absolute path ${JSON.stringify(entryName)}`);
+  }
+
+  const segments = entryName.split(/[\\/]+/);
+  for (const seg of segments) {
+    if (seg === '..') {
+      throw new Error(`unsafe zip entry${where}: path-traversal segment in ${JSON.stringify(entryName)}`);
+    }
+  }
+}
+
+/**
+ * Convenience: validate every name in an iterable. Throws on the first
+ * offender (fail-fast) rather than collecting all violations.
+ *
+ * @param {Iterable<string>} names
+ * @param {string} [context]
+ */
+function assertAllSafeZipEntryNames(names, context) {
+  for (const name of names) {
+    assertSafeZipEntryName(name, context);
+  }
+}
+
+module.exports = {
+  assertSafeZipEntryName,
+  assertAllSafeZipEntryNames,
+};