mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-14 17:52:44 -04:00
352ae489f1
Backports three merged security fixes from main to release/10: - Contain hoisted dependency aliases so a crafted lockfile alias cannot escape node_modules or overwrite pnpm-owned layout. The hoisted graph builder now validates each alias at the safeJoinModulesDir sink. (GHSA-fr4h-3cph-29xv, #12343) - Contain pnpm patch-remove deletions to the configured patches directory. (#12341) - Reject path-traversal config dependency names and versions from pnpm-workspace.yaml before they are used to build filesystem paths. (GHSA-qrv3-253h-g69c, #12470) Written by an agent (Claude Code, claude-opus-4-8).
20 lines
979 B
TypeScript
20 lines
979 B
TypeScript
import path from 'path'
|
|
|
|
import { isSubdirectory } from '../src/isSubdirectory.js'
|
|
|
|
test('isSubdirectory() accepts paths inside the parent directory', () => {
|
|
expect(isSubdirectory('/project/patches', '/project/patches/pkg.patch')).toBe(true)
|
|
expect(isSubdirectory('/project/patches', '/project/patches/..pkg/pkg.patch')).toBe(true)
|
|
})
|
|
|
|
test('isSubdirectory() rejects parent traversal and sibling prefixes', () => {
|
|
expect(isSubdirectory('/project/patches', '/project/pkg.patch')).toBe(false)
|
|
expect(isSubdirectory('/project/patches', '/project/patches-other/pkg.patch')).toBe(false)
|
|
})
|
|
|
|
test('isSubdirectory() rejects Windows drive and UNC escapes', () => {
|
|
expect(isSubdirectory('C:\\project\\patches', 'D:\\pkg.patch', path.win32)).toBe(false)
|
|
expect(isSubdirectory('C:\\project\\patches', '\\\\server\\share\\pkg.patch', path.win32)).toBe(false)
|
|
expect(isSubdirectory('C:\\project\\patches', 'C:\\project\\patches\\..pkg\\pkg.patch', path.win32)).toBe(true)
|
|
})
|