|
| 1 | +From 14f532dae3732b4bdba2821d31d6bce663cf8dd5 Mon Sep 17 00:00:00 2001 |
| 2 | +From: jykanase < [email protected]> |
| 3 | +Date: Tue, 10 Jun 2025 07:51:46 +0000 |
| 4 | +Subject: [PATCH] CVE-2025-48387 |
| 5 | + |
| 6 | +Upstream Patch Reference: https://github.com/mafintosh/tar-fs/commit/647447b572bc135c41035e82ca7b894f02b17f0f |
| 7 | +--- |
| 8 | + .../bower/lib/node_modules/tar-fs/index.js | 39 +++++++++++-------- |
| 9 | + 1 file changed, 22 insertions(+), 17 deletions(-) |
| 10 | + |
| 11 | +diff --git a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js |
| 12 | +index 3fd93bc..7659b01 100644 |
| 13 | +--- a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js |
| 14 | ++++ b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js |
| 15 | +@@ -266,16 +266,20 @@ exports.extract = function (cwd, opts) { |
| 16 | + var onlink = function () { |
| 17 | + if (win32) return next() // skip links on win for now before it can be tested |
| 18 | + xfs.unlink(name, function () { |
| 19 | +- var dst = path.join(cwd, path.join('/', header.linkname)) |
| 20 | ++ var link = path.join(cwd, path.join('/', header.linkname)) |
| 21 | + |
| 22 | +- xfs.link(dst, name, function (err) { |
| 23 | +- if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) { |
| 24 | +- stream = xfs.createReadStream(dst) |
| 25 | +- return onfile() |
| 26 | +- } |
| 27 | ++ fs.realpath(link, function (err, dst) { |
| 28 | ++ if (err || !inCwd(dst)) return next(new Error(name + ' is not a valid hardlink')) |
| 29 | + |
| 30 | +- stat(err) |
| 31 | +- }) |
| 32 | ++ xfs.link(dst, name, function (err) { |
| 33 | ++ if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) { |
| 34 | ++ stream = xfs.createReadStream(dst) |
| 35 | ++ return onfile() |
| 36 | ++ } |
| 37 | ++ |
| 38 | ++ stat(err) |
| 39 | ++ }) |
| 40 | ++ }) |
| 41 | + }) |
| 42 | + } |
| 43 | + |
| 44 | +@@ -297,19 +301,19 @@ exports.extract = function (cwd, opts) { |
| 45 | + }) |
| 46 | + } |
| 47 | + |
| 48 | +- if (header.type === 'directory') { |
| 49 | +- stack.push([name, header.mtime]) |
| 50 | +- return mkdirfix(name, { |
| 51 | +- fs: xfs, own: own, uid: header.uid, gid: header.gid |
| 52 | +- }, stat) |
| 53 | +- } |
| 54 | +- |
| 55 | +- var dir = path.dirname(name) |
| 56 | ++ var dir = path.join(name, '.') === path.join(cwd, '.') ? cwd : path.dirname(name) |
| 57 | + |
| 58 | + validate(xfs, dir, path.join(cwd, '.'), function (err, valid) { |
| 59 | + if (err) return next(err) |
| 60 | + if (!valid) return next(new Error(dir + ' is not a valid path')) |
| 61 | + |
| 62 | ++ if (header.type === 'directory') { |
| 63 | ++ stack.push([name, header.mtime]) |
| 64 | ++ return mkdirfix(name, { |
| 65 | ++ fs: xfs, own: own, uid: header.uid, gid: header.gid |
| 66 | ++ }, stat) |
| 67 | ++ } |
| 68 | ++ |
| 69 | + mkdirfix(dir, { |
| 70 | + fs: xfs, own: own, uid: header.uid, gid: header.gid |
| 71 | + }, function (err) { |
| 72 | +@@ -336,8 +340,9 @@ exports.extract = function (cwd, opts) { |
| 73 | + |
| 74 | + function validate (fs, name, root, cb) { |
| 75 | + if (name === root) return cb(null, true) |
| 76 | ++ |
| 77 | + fs.lstat(name, function (err, st) { |
| 78 | +- if (err && err.code !== 'ENOENT') return cb(err) |
| 79 | ++ if (err && err.code !== 'ENOENT' && err.code !== 'EPERM') return cb(err) |
| 80 | + if (err || st.isDirectory()) return validate(fs, path.join(name, '..'), root, cb) |
| 81 | + cb(null, false) |
| 82 | + }) |
| 83 | +-- |
| 84 | +2.45.2 |
| 85 | + |
0 commit comments