pnpm/store/cafs/test/index.ts

import fs from 'node:fs'
import path from 'node:path'

import { fixtures } from '@pnpm/test-fixtures'
import { symlinkDir } from 'symlink-dir'
import { temporaryDirectory } from 'tempy'

import {
  checkPkgFilesIntegrity,
  createCafs,
  getFilePathByModeInCafs,
} from '../src/index.js'
import { parseTarball } from '../src/parseTarball.js'

const f = fixtures(import.meta.dirname)

describe('cafs', () => {
  it('unpack', () => {
    const dest = temporaryDirectory()
    const cafs = createCafs(dest)
    const { filesIndex } = cafs.addFilesFromTarball(
      fs.readFileSync(f.find('node-gyp-6.1.0.tgz'))
    )
    expect(filesIndex.size).toBe(121)
    const pkgFile = filesIndex.get('package.json')
    expect(pkgFile!.size).toBe(1121)
    expect(pkgFile!.mode).toBe(420)
    expect(typeof pkgFile!.checkedAt).toBe('number')
    expect(pkgFile!.digest).toBe('f310afae50bb5b74e5c17c5eb6fe426538b9deccd88664fbb66a5717fb6d36d86d4d1f530bb63b58914f9894e81da490e2e39bb99c8e01174e258358b9349b5c')
  })

  it('replaces an already existing file, if the integrity of it was broken', () => {
    const storeDir = temporaryDirectory()
    const srcDir = path.join(import.meta.dirname, 'fixtures/one-file')
    const addFiles = () => createCafs(storeDir).addFilesFromDir(srcDir)

    let addFilesResult = addFiles()

    // Modifying the file in the store
    const { digest } = addFilesResult.filesIndex.get('foo.txt')!
    const filePath = getFilePathByModeInCafs(storeDir, digest, 420)
    fs.appendFileSync(filePath, 'bar')

    addFilesResult = addFiles()
    expect(fs.readFileSync(filePath, 'utf8')).toBe('foo\n')
    expect(addFilesResult.manifest).toBeUndefined()
  })

  it('ignores broken symlinks when traversing subdirectories', () => {
    const storeDir = temporaryDirectory()
    const srcDir = path.join(import.meta.dirname, 'fixtures/broken-symlink')
    const addFiles = () => createCafs(storeDir).addFilesFromDir(srcDir)

    const { filesIndex } = addFiles()
    expect(filesIndex.get('subdir/should-exist.txt')).toBeDefined()
  })

  it('symlinks are resolved and added as regular files', async () => {
    const storeDir = temporaryDirectory()
    const srcDir = temporaryDirectory()
    const filePath = path.join(srcDir, 'index.js')
    const symlinkPath = path.join(srcDir, 'symlink.js')
    fs.writeFileSync(filePath, '// comment', 'utf8')
    fs.symlinkSync(filePath, symlinkPath)
    fs.mkdirSync(path.join(srcDir, 'lib'))
    fs.writeFileSync(path.join(srcDir, 'lib/index.js'), '// comment 2', 'utf8')
    await symlinkDir(path.join(srcDir, 'lib'), path.join(srcDir, 'lib-symlink'))

    const { filesIndex } = createCafs(storeDir).addFilesFromDir(srcDir)
    expect(filesIndex.get('symlink.js')).toBeDefined()
    expect(filesIndex.get('symlink.js')).toStrictEqual(filesIndex.get('index.js'))
    expect(filesIndex.get('lib/index.js')).toBeDefined()
    expect(filesIndex.get('lib/index.js')).toStrictEqual(filesIndex.get('lib-symlink/index.js'))
  })

  // Security test: symlinks pointing outside the package root should be rejected
  // This prevents file: and git: dependencies from leaking local data via malicious symlinks
  it('rejects symlinks pointing outside the package directory', () => {
    const storeDir = temporaryDirectory()
    const srcDir = temporaryDirectory()

    // Create a legitimate file inside the package
    fs.writeFileSync(path.join(srcDir, 'legit.txt'), 'legitimate content')

    // Create a file outside the package that a malicious symlink tries to leak
    const outsideDir = temporaryDirectory()
    const secretFile = path.join(outsideDir, 'secret.txt')
    fs.writeFileSync(secretFile, 'secret content')

    // Create a symlink pointing to the file outside the package
    fs.symlinkSync(secretFile, path.join(srcDir, 'leak.txt'))

    const { filesIndex } = createCafs(storeDir).addFilesFromDir(srcDir)

    // The legitimate file should be included
    expect(filesIndex.get('legit.txt')).toBeDefined()

    // The symlink pointing outside should be skipped (security fix)
    expect(filesIndex.get('leak.txt')).toBeUndefined()
  })

  // Security test: symlinked directories pointing outside the package should be rejected
  it('rejects symlinked directories pointing outside the package', () => {
    const storeDir = temporaryDirectory()
    const srcDir = temporaryDirectory()

    // Create a legitimate file inside the package
    fs.writeFileSync(path.join(srcDir, 'legit.txt'), 'legitimate content')

    // Create a directory with secret files outside the package
    const outsideDir = temporaryDirectory()
    fs.writeFileSync(path.join(outsideDir, 'secret.txt'), 'secret content')

    // Create a symlink to the outside directory
    fs.symlinkSync(outsideDir, path.join(srcDir, 'leak-dir'))

    const { filesIndex } = createCafs(storeDir).addFilesFromDir(srcDir)

    // The legitimate file should be included
    expect(filesIndex.get('legit.txt')).toBeDefined()

    // Files from the symlinked directory pointing outside should NOT be included
    expect(filesIndex.get('leak-dir/secret.txt')).toBeUndefined()
  })

  // Symlinked node_modules at the root should be skipped just like regular node_modules
  it('skips symlinked node_modules directory at root', () => {
    const storeDir = temporaryDirectory()
    const srcDir = temporaryDirectory()

    // Create a legitimate file inside the package
    fs.writeFileSync(path.join(srcDir, 'index.js'), '// code')

    // Create a target directory for the symlink (inside the package to pass containment check)
    const targetDir = path.join(srcDir, '.deps')
    fs.mkdirSync(targetDir)
    fs.writeFileSync(path.join(targetDir, 'dep.js'), '// dep')

    // Create a symlinked node_modules directory at the root
    fs.symlinkSync(targetDir, path.join(srcDir, 'node_modules'))

    const { filesIndex } = createCafs(storeDir).addFilesFromDir(srcDir)

    // The legitimate file should be included
    expect(filesIndex.get('index.js')).toBeDefined()
    // The target files under .deps should be included
    expect(filesIndex.get('.deps/dep.js')).toBeDefined()

    // Files from symlinked node_modules at root should NOT be included
    expect(filesIndex.get('node_modules/dep.js')).toBeUndefined()
  })
})

describe('checkPkgFilesIntegrity()', () => {
  it("doesn't fail if file was removed from the store", () => {
    const storeDir = temporaryDirectory()
    expect(checkPkgFilesIntegrity(storeDir, {
      algo: 'sha512',
      files: new Map([
        ['foo', {
          digest: 'f310afae50bb5b74e5c17c5eb6fe426538b9deccd88664fbb66a5717fb6d36d86d4d1f530bb63b58914f9894e81da490e2e39bb99c8e01174e258358b9349b5c',
          mode: 420,
          size: 10,
        }],
      ]),
    }).passed).toBeFalsy()
  })
})

test('file names are normalized when unpacking a tarball', () => {
  const dest = temporaryDirectory()
  const cafs = createCafs(dest)
  const { filesIndex } = cafs.addFilesFromTarball(
    fs.readFileSync(f.find('colorize-semver-diff.tgz'))
  )
  expect(Array.from(filesIndex.keys()).sort()).toStrictEqual([
    'LICENSE',
    'README.md',
    'lib/index.d.ts',
    'lib/index.js',
    'package.json',
  ])
})

test('broken magic in tarball headers is handled gracefully', () => {
  const dest = temporaryDirectory()
  const cafs = createCafs(dest)
  cafs.addFilesFromTarball(
    fs.readFileSync(f.find('jquery.dirtyforms-2.0.0.tgz'))
  )
})

test('unpack an older version of tar that prefixes with spaces', () => {
  const dest = temporaryDirectory()
  const cafs = createCafs(dest)
  const { filesIndex } = cafs.addFilesFromTarball(
    fs.readFileSync(f.find('parsers-3.0.0-rc.48.1.tgz'))
  )
  expect(Array.from(filesIndex.keys()).sort()).toStrictEqual([
    'lib/grammars/resolution.d.ts',
    'lib/grammars/resolution.js',
    'lib/grammars/resolution.pegjs',
    'lib/grammars/shell.d.ts',
    'lib/grammars/shell.js',
    'lib/grammars/shell.pegjs',
    'lib/grammars/syml.d.ts',
    'lib/grammars/syml.js',
    'lib/grammars/syml.pegjs',
    'lib/index.d.ts',
    'lib/index.js',
    'lib/resolution.d.ts',
    'lib/resolution.js',
    'lib/shell.d.ts',
    'lib/shell.js',
    'lib/syml.d.ts',
    'lib/syml.js',
    'package.json',
  ])
})

test('unpack a tarball that contains hard links', () => {
  const dest = temporaryDirectory()
  const cafs = createCafs(dest)
  const { filesIndex } = cafs.addFilesFromTarball(
    fs.readFileSync(f.find('vue.examples.todomvc.todo-store-0.0.1.tgz'))
  )
  expect(filesIndex.size).toBeGreaterThan(0)
})

// Regression test for Windows path traversal vulnerability
// A malicious tarball entry like "foo\..\..\..\.npmrc" should have its path normalized
test('path traversal with backslashes is blocked (Windows security fix)', () => {
  // Create a minimal valid tarball with a malicious filename
  const tarBuffer = createTarballWithEntry('foo\\..\\..\\..\\malicious.txt', 'evil content')

  const result = parseTarball(tarBuffer)
  const fileNames = Array.from(result.files.keys())

  // The path should be normalized - no ".." segments and no path traversal
  for (const fileName of fileNames) {
    expect(fileName).not.toContain('..')
    expect(fileName).not.toContain('\\')
  }
})

// Helper to create a minimal tarball buffer with a single entry
function createTarballWithEntry (fileName: string, content: string): Buffer {
  const contentBytes = Buffer.from(content, 'utf8')

  // Create a 512-byte header
  const header = Buffer.alloc(512, 0)

  // File name at offset 0 (max 100 chars)
  const nameToWrite = `package/${fileName}`
  header.write(nameToWrite, 0, Math.min(nameToWrite.length, 100), 'utf8')

  // File mode at offset 100 (octal, 8 bytes) - 0644
  header.write('0000644\0', 100, 8, 'utf8')

  // UID at offset 108 (octal, 8 bytes)
  header.write('0000000\0', 108, 8, 'utf8')

  // GID at offset 116 (octal, 8 bytes)
  header.write('0000000\0', 116, 8, 'utf8')

  // File size at offset 124 (octal, 12 bytes)
  const sizeOctal = contentBytes.length.toString(8).padStart(11, '0')
  header.write(sizeOctal + '\0', 124, 12, 'utf8')

  // Mtime at offset 136 (octal, 12 bytes)
  header.write('00000000000\0', 136, 12, 'utf8')

  // File type at offset 156 ('0' for regular file)
  header[156] = '0'.charCodeAt(0)

  // USTAR indicator at offset 257
  header.write('ustar\0', 257, 6, 'utf8')
  header.write('00', 263, 2, 'utf8')

  // Compute checksum (offset 148, 8 bytes) - sum of all header bytes treating checksum field as spaces
  // First, fill checksum field with spaces
  header.fill(' ', 148, 156)
  let checksum = 0
  for (let i = 0; i < 512; i++) {
    checksum += header[i]
  }
  const checksumOctal = checksum.toString(8).padStart(6, '0')
  header.write(checksumOctal + '\0 ', 148, 8, 'utf8')

  // Content block (padded to 512 bytes)
  const contentBlock = Buffer.alloc(512, 0)
  contentBytes.copy(contentBlock)

  // End-of-archive marker (two 512-byte blocks of zeros)
  const endMarker = Buffer.alloc(1024, 0)

  return Buffer.concat([header, contentBlock, endMarker])
}

// Related issue: https://github.com/pnpm/pnpm/issues/7120
test('unpack should not fail when the tarball format seems to be not USTAR or GNU TAR', () => {
  const dest = temporaryDirectory()
  const cafs = createCafs(dest)
  const { filesIndex } = cafs.addFilesFromTarball(
    fs.readFileSync(f.find('devextreme-17.1.6.tgz'))
  )
  expect(filesIndex.size).toBeGreaterThan(0)
})