pnpm/bins/resolver/test/index.ts

import path from 'node:path'

import { getBinsFromPackageManifest } from '@pnpm/bins.resolver'

test('getBinsFromPackageManifest()', async () => {
  expect(
    await getBinsFromPackageManifest({
      bin: 'one-bin',
      name: 'one-bin',
      version: '1.0.0',
    }, process.cwd())).toStrictEqual(
    [{
      name: 'one-bin',
      path: path.resolve('one-bin'),
    }]
  )
})

test('getBinsFromPackageManifest() should allow $ as command name', async () => {
  expect(
    await getBinsFromPackageManifest({
      bin: {
        $: './undollar.js',
      },
      name: 'undollar',
      version: '1.0.0',
    }, process.cwd())).toStrictEqual(
    [{
      name: '$',
      path: path.resolve('undollar.js'),
    }]
  )
})

test('find all the bin files from a bin directory', async () => {
  const fixtures = path.join(import.meta.dirname, 'fixtures')
  expect(
    await getBinsFromPackageManifest({
      name: 'bin-dir',
      version: '1.0.0',

      directories: { bin: 'bin-dir' },
    }, fixtures)).toStrictEqual(
    [
      {
        name: 'rootBin.js',
        path: path.join(fixtures, 'bin-dir/rootBin.js'),
      },
      {
        name: 'subBin.js',
        path: path.join(fixtures, 'bin-dir/subdir/subBin.js'),
      },
    ]
  )
})

test('get bin of scoped package', async () => {
  expect(
    await getBinsFromPackageManifest({
      bin: 'bin.js',
      name: '@foo/bar',
      version: '1.0.0',
    }, process.cwd())).toStrictEqual(
    [{
      name: 'bar',
      path: path.resolve('bin.js'),
    }]
  )
})

test('skip dangerous bin names', async () => {
  expect(
    await getBinsFromPackageManifest({
      name: 'foo',
      version: '1.0.0',

      bin: {
        '../bad': './bad',
        '..\\bad': './bad',
        good: './good',
        '~/bad': './bad',
      },
    }, process.cwd())).toStrictEqual(
    [
      {
        name: 'good',
        path: path.resolve('good'),
      },
    ]
  )
})

test('skip dangerous bin locations', async () => {
  expect(
    await getBinsFromPackageManifest({
      name: 'foo',
      version: '1.0.0',

      bin: {
        bad: '../bad',
        good: './good',
      },
    }, process.cwd())).toStrictEqual(
    [
      {
        name: 'good',
        path: path.resolve('good'),
      },
    ]
  )
})

test('get bin from scoped bin name', async () => {
  expect(
    await getBinsFromPackageManifest({
      name: '@foo/a',
      version: '1.0.0',
      bin: {
        '@foo/a': './a',
      },
    }, process.cwd())).toStrictEqual(
    [
      {
        name: 'a',
        path: path.resolve('a'),
      },
    ]
  )
})

test('skip scoped bin names with path traversal', async () => {
  expect(
    await getBinsFromPackageManifest({
      name: 'malicious',
      version: '1.0.0',
      bin: {
        '@scope/../../.npmrc': './malicious.js',
        '@scope/../etc/passwd': './evil.js',
        '@scope/legit': './good.js',
      },
    }, process.cwd())).toStrictEqual([
    {
      name: 'legit',
      path: path.resolve('good.js'),
    },
  ])
})

test('skip directories.bin with path traversal', async () => {
  // Security test: malicious packages can try to escape the package root
  // using directories.bin to chmod files at arbitrary locations
  expect(
    await getBinsFromPackageManifest({
      name: 'malicious',
      version: '1.0.0',
      directories: {
        bin: '../../../../tmp/target',
      },
    }, process.cwd())).toStrictEqual([])

  expect(
    await getBinsFromPackageManifest({
      name: 'malicious',
      version: '1.0.0',
      directories: {
        bin: '../../../etc',
      },
    }, process.cwd())).toStrictEqual([])
})