WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-08-17 21:15:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): verify legacy files after opening

Browse Source
This commit is contained in:
haelyra
2026-08-13 17:20:48 -04:00
parent 3f5bf22966
commit efdf17b034
2 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/lib/codex-legacy-sync.js
+14 -13
View File
@@ -17,21 +17,22 @@ function getStatePath(codexHome) {
function openRegularFileNoFollow(filePath, writable = false) {
const noFollow = fs.constants.O_NOFOLLOW || 0;
const flags = (writable ? fs.constants.O_RDWR : fs.constants.O_RDONLY) | noFollow;
let pathStat;
try {
pathStat = fs.lstatSync(filePath, { bigint: true });
} catch (error) {
if (error.code === 'ENOENT') return null;
throw error;
}
if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
throw new Error(`Refusing to manage non-regular legacy sync path: ${filePath}`);
}
let descriptor;
try {
descriptor = fs.openSync(filePath, flags);
} catch (error) {
if (error.code === 'ENOENT') return null;
if (error.code === 'ENOENT') {
try {
const unresolved = fs.lstatSync(filePath);
if (unresolved.isSymbolicLink() || !unresolved.isFile()) {
throw new Error(`Refusing to manage non-regular legacy sync path: ${filePath}`);
}
} catch (lstatError) {
if (lstatError.code === 'ENOENT') return null;
throw lstatError;
}
throw error;
}
if (error.code === 'ELOOP') {
throw new Error(`Refusing to manage non-regular legacy sync path: ${filePath}`);
}
@@ -52,10 +53,10 @@ function openRegularFileNoFollow(filePath, writable = false) {
!descriptorStat.isFile()
|| !finalPathStat.isFile()
|| finalPathStat.isSymbolicLink()
|| descriptorStat.dev !== pathStat.dev
|| descriptorStat.ino !== pathStat.ino
|| descriptorStat.dev !== finalPathStat.dev
|| descriptorStat.ino !== finalPathStat.ino
|| descriptorStat.nlink !== 1n
|| finalPathStat.nlink !== 1n
) {
fs.closeSync(descriptor);
throw new Error(`Refusing to manage non-regular legacy sync path: ${filePath}`);