dc04bf6761Removes the reliance on prototype bound methods internally so that Uint8Arrays can be set as the bound `this` value when calling the various Buffer methods. Introduces some additional tamper protection by removing internal reliance on writable properties. Fixes: https://github.com/nodejs/node/issues/56577 PR-URL: https://github.com/nodejs/node/pull/56578 Reviewed-By: Anna Henningsen <anna@addaleax.net>
123 lines
3.5 KiB
JavaScript
123 lines
3.5 KiB
JavaScript
'use strict'
|
|
|
|
const common = require('../../common');
|
|
|
|
const assert = require('assert');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
|
|
const { resolve } = path;
|
|
// This should not affect how the permission model resolves paths.
|
|
try {
|
|
path.resolve = (s) => s;
|
|
assert.fail('should not be called');
|
|
} catch {}
|
|
|
|
const blockedFolder = process.env.BLOCKEDFOLDER;
|
|
const allowedFolder = process.env.ALLOWEDFOLDER;
|
|
const traversalPath = allowedFolder + '/../file.md';
|
|
const traversalFolderPath = allowedFolder + '/../folder';
|
|
const bufferTraversalPath = Buffer.from(traversalPath);
|
|
const uint8ArrayTraversalPath = new TextEncoder().encode(traversalPath);
|
|
|
|
{
|
|
assert.ok(process.permission.has('fs.read', allowedFolder));
|
|
assert.ok(process.permission.has('fs.write', allowedFolder));
|
|
assert.ok(!process.permission.has('fs.read', blockedFolder));
|
|
assert.ok(!process.permission.has('fs.write', blockedFolder));
|
|
}
|
|
|
|
{
|
|
fs.writeFile(traversalPath, 'test', common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemWrite',
|
|
resource: path.toNamespacedPath(traversalPath),
|
|
}));
|
|
}
|
|
|
|
{
|
|
fs.readFile(traversalPath, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemRead',
|
|
resource: path.toNamespacedPath(traversalPath),
|
|
}));
|
|
}
|
|
|
|
{
|
|
assert.throws(() => {
|
|
fs.mkdtempSync(traversalFolderPath);
|
|
}, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemWrite',
|
|
resource: traversalFolderPath + 'XXXXXX',
|
|
}));
|
|
}
|
|
|
|
{
|
|
fs.mkdtemp(traversalFolderPath, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemWrite',
|
|
resource: traversalFolderPath + 'XXXXXX',
|
|
}));
|
|
}
|
|
|
|
{
|
|
fs.readFile(bufferTraversalPath, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemRead',
|
|
resource: path.toNamespacedPath(traversalPath),
|
|
}));
|
|
}
|
|
|
|
{
|
|
fs.lstat(bufferTraversalPath, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemRead',
|
|
// lstat checks and throw on JS side.
|
|
// resource is only resolved on C++ (is_granted)
|
|
resource: bufferTraversalPath.toString(),
|
|
}));
|
|
}
|
|
|
|
{
|
|
fs.readFile(uint8ArrayTraversalPath, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemRead',
|
|
resource: path.toNamespacedPath(traversalPath),
|
|
}));
|
|
}
|
|
|
|
// Monkey-patching Buffer internals should also not allow path traversal.
|
|
{
|
|
const extraChars = '.'.repeat(40);
|
|
const traversalPathWithExtraChars = traversalPath + extraChars;
|
|
const traversalPathWithExtraBytes = Buffer.from(traversalPathWithExtraChars);
|
|
|
|
Buffer.prototype.utf8Write = ((w) => function(str, ...args) {
|
|
assert.strictEqual(str, resolve(traversalPath) + extraChars);
|
|
return w.apply(this, [traversalPath, ...args]);
|
|
})(Buffer.prototype.utf8Write);
|
|
|
|
assert.throws(() => {
|
|
fs.readFileSync(traversalPathWithExtraBytes);
|
|
}, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemRead',
|
|
resource: path.toNamespacedPath(traversalPathWithExtraChars),
|
|
}));
|
|
|
|
assert.throws(() => {
|
|
fs.readFileSync(new TextEncoder().encode(traversalPathWithExtraBytes.toString()));
|
|
}, common.expectsError({
|
|
code: 'ERR_ACCESS_DENIED',
|
|
permission: 'FileSystemRead',
|
|
resource: path.toNamespacedPath(traversalPathWithExtraChars),
|
|
}));
|
|
}
|
|
|
|
{
|
|
assert.ok(!process.permission.has('fs.read', traversalPath));
|
|
assert.ok(!process.permission.has('fs.write', traversalPath));
|
|
assert.ok(!process.permission.has('fs.read', traversalFolderPath));
|
|
assert.ok(!process.permission.has('fs.write', traversalFolderPath));
|
|
}
|