Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: origRealpath in fs patch is not the original fs.realpath #1898

Open
fa93hws opened this issue Aug 19, 2024 · 0 comments
Open

[Bug]: origRealpath in fs patch is not the original fs.realpath #1898

fa93hws opened this issue Aug 19, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@fa93hws
Copy link

fa93hws commented Aug 19, 2024

What happened?

In the fs patch, it's assumed that methods in fs is independent, so original fs methods before patched are still accessible:

const origReadlink = fs.readlink.bind(fs);
const origRealpath = fs.realpath.bind(fs);

However that's not the case, and it can be easily reproduced via running the following code snippet:

const fs = require('fs');
fs.readlink = () => {
  throw new Error('123');
}
fs.realpath('<some smybolic link>', (err, out) => {
});

which throws an error:

> Uncaught Error: 123
    at fs.readlink (REPL19:1:29)
    at node:fs:2908:10
> 

That indicates that the behaviour of origRealpath has been changed as soon as readlink got patched! And it can lead to sandbox escape from here.
In my case, origRealpath returns something in the bazel out directory which is again a symlink, and origReadlink later resolves it to something in my source directory.

Version

Only nodejs version matters:

Node.js v20.12.2

How to reproduce

No response

Any other information?

No response

@fa93hws fa93hws added the bug Something isn't working label Aug 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant