Zoltan Kochan
8cd45fdf36
AdmZip's Utils.writeFileTo opens each destination with fs.openSync(path, "w"), which resolves symlinks, and Utils.sanitize only compares the entry name as a string against the extraction root (GHSA-vwc7-r8mq-g2x9). A symlink that already exists at a destination therefore redirects the write anywhere the process can write. No patched adm-zip release exists. extractZipToTarget extracted prefixed archives into path.dirname(targetDir), which is the store's shared tmp directory, so every entry landed at the fixed path <store>/tmp/<prefix>/... Node.js on Windows and Bun on every platform set a prefix; Deno does not and already extracted into the random directory from cafs.tempDir(). On a store shared by several users, another user could pre-create a symlink at that fixed path and have pnpm overwrite an arbitrary file. pnpm's own validatePathSecurity does not help: it checks the entry string, which is exactly the check the advisory calls insufficient. Extract into a directory created with mkdtemp next to targetDir instead, on the same filesystem so the rename stays cheap, and remove it afterwards. That leaves no predictable destination to plant a link at, independent of what adm-zip does. The advisory is added to auditConfig.ignoreGhsas since no upgrade exists.
@pnpm/fetching.binary-fetcher
A fetcher for binary archives
Installation
pnpm add @pnpm/fetching.binary-fetcher
Testing
Test Fixtures
The test/fixtures/ directory contains malicious ZIP files for testing path traversal protection:
| File | Entry Path | Purpose |
|---|---|---|
path-traversal.zip |
../../../.npmrc |
Tests ../ escape sequences |
absolute-path.zip |
/etc/passwd |
Tests absolute path entries |
backslash-traversal.zip |
..\..\..\evil.txt |
Tests Windows backslash traversal (Windows-only) |
These fixtures are manually crafted because AdmZip's addFile() sanitizes paths automatically.
Note: The backslash test only runs on Windows because
\is a valid filename character on Unix.
Regenerating Fixtures
node --experimental-strip-types scripts/create-fixtures.ts
License
MIT