From ff38e91a707a8172108a2bcbedc0c3aa80aa512c Mon Sep 17 00:00:00 2001 From: reaper Date: Fri, 28 Aug 2026 01:02:07 -0500 Subject: [PATCH] fix: accept runtime archive root entry --- src/main/nativeRuntime.test.ts | 2 +- src/main/nativeRuntime.ts | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/main/nativeRuntime.test.ts b/src/main/nativeRuntime.test.ts index 611f8db..88e99ac 100644 --- a/src/main/nativeRuntime.test.ts +++ b/src/main/nativeRuntime.test.ts @@ -29,7 +29,7 @@ describe('Aurora Native runtime manifest', () => { }) ).toThrow(/checksum/)) it('rejects archive entries that escape the installation directory', () => { - expect(() => validateArchiveEntries('./runtime.json\n./bin/php\n')).not.toThrow() + expect(() => validateArchiveEntries('./\n./runtime.json\n./bin/php\n')).not.toThrow() expect(() => validateArchiveEntries('./runtime.json\n../outside\n')).toThrow( /Unsafe runtime archive entry/ ) diff --git a/src/main/nativeRuntime.ts b/src/main/nativeRuntime.ts index b331607..c27ad45 100644 --- a/src/main/nativeRuntime.ts +++ b/src/main/nativeRuntime.ts @@ -117,8 +117,9 @@ export function validateArchiveEntries(output: string): void { if (!entries.length || entries.length > 50000) throw new Error('Runtime archive has an invalid file count.') for (const entry of entries) { + if (entry === '.' || entry === './') continue const normalized = entry.replace(/^\.\//, '') - if (!normalized || isAbsolute(normalized) || normalized.split('/').includes('..')) + if (!normalized || isAbsolute(normalized) || normalized.split(/[\\/]/).includes('..')) throw new Error(`Unsafe runtime archive entry: ${entry}`) } }