R3ap3r/aurora-dockside
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: accept runtime archive root entry

Browse Source
This commit is contained in:
reaper
2026-08-28 01:02:07 -05:00
parent a5e942f1f9
commit ff38e91a70
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/nativeRuntime.test.ts
+1 -1
View File
@@ -29,7 +29,7 @@ describe('Aurora Native runtime manifest', () => {
}) })
).toThrow(/checksum/)) ).toThrow(/checksum/))
it('rejects archive entries that escape the installation directory', () => { it('rejects archive entries that escape the installation directory', () => {
expect(() => validateArchiveEntries('./runtime.json\n./bin/php\n')).not.toThrow() expect(() => validateArchiveEntries('./\n./runtime.json\n./bin/php\n')).not.toThrow()
expect(() => validateArchiveEntries('./runtime.json\n../outside\n')).toThrow( expect(() => validateArchiveEntries('./runtime.json\n../outside\n')).toThrow(
/Unsafe runtime archive entry/ /Unsafe runtime archive entry/
) )
src/main/nativeRuntime.ts
+2 -1
View File
@@ -117,8 +117,9 @@ export function validateArchiveEntries(output: string): void {
if (!entries.length || entries.length > 50000) if (!entries.length || entries.length > 50000)
throw new Error('Runtime archive has an invalid file count.') throw new Error('Runtime archive has an invalid file count.')
for (const entry of entries) { for (const entry of entries) {
if (entry === '.' || entry === './') continue
const normalized = entry.replace(/^\.\//, '') const normalized = entry.replace(/^\.\//, '')
if (!normalized || isAbsolute(normalized) || normalized.split('/').includes('..')) if (!normalized || isAbsolute(normalized) || normalized.split(/[\\/]/).includes('..'))
throw new Error(`Unsafe runtime archive entry: ${entry}`) throw new Error(`Unsafe runtime archive entry: ${entry}`)
} }
} }