fix: reject symlinked output ancestors

Author: BartWaardenburg

crates/cli/src/main.rs

@@ -648,6 +648,98 @@ fn extraction_io(action: &str, path: &Path, error: &io::Error) -> CliError {
     CliError::io(format!("{action} {}: {error}", path.display()))
 }
 
+fn is_known_immutable_root_alias(name: &OsStr) -> bool {
+    #[cfg(target_os = "macos")]
+    {
+        name == OsStr::new("var") || name == OsStr::new("tmp")
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        let _ = name;
+        false
+    }
+}
+
+fn open_or_create_output_component(
+    parent: &Dir,
+    name: &OsStr,
+    output_dir: &Path,
+    allow_root_alias: bool,
+) -> Result<Dir, CliError> {
+    match parent.open_dir_nofollow(name) {
+        Ok(directory) => return Ok(directory),
+        Err(error) if error.kind() != io::ErrorKind::NotFound => {
+            if allow_root_alias
+                && is_known_immutable_root_alias(name)
+                && parent
+                    .symlink_metadata(name)
+                    .is_ok_and(|metadata| metadata.file_type().is_symlink())
+            {
+                // These macOS root aliases are not mutable by ordinary users.
+                return parent.open_dir(name).map_err(|open_error| {
+                    extraction_io("failed to open output directory", output_dir, &open_error)
+                });
+            }
+            return Err(extraction_io("failed to open output directory", output_dir, &error));
+        }
+        Err(_) => {}
+    }
+
+    match parent.create_dir(name) {
+        Ok(()) => {}
+        Err(error) if error.kind() == io::ErrorKind::AlreadyExists => {}
+        Err(error) => {
+            return Err(extraction_io("failed to create output directory", output_dir, &error));
+        }
+    }
+
+    parent
+        .open_dir_nofollow(name)
+        .map_err(|error| extraction_io("failed to open output directory", output_dir, &error))
+}
+
+fn open_or_create_output_dir(output_dir: &Path) -> Result<Dir, CliError> {
+    let absolute = std::path::absolute(output_dir)
+        .map_err(|error| extraction_io("failed to resolve output directory", output_dir, &error))?;
+    let root_path = absolute.ancestors().last().ok_or_else(|| {
+        CliError::io(format!("output directory has no root: {}", output_dir.display()))
+    })?;
+    let relative = absolute.strip_prefix(root_path).map_err(|error| {
+        CliError::io(format!(
+            "failed to resolve output directory {}: {error}",
+            output_dir.display()
+        ))
+    })?;
+    let mut components = Vec::new();
+    for component in relative.components() {
+        match component {
+            Component::Normal(name) => components.push(name.to_os_string()),
+            Component::CurDir => {}
+            Component::ParentDir => {
+                components.pop().ok_or_else(|| {
+                    CliError::path_traversal(format!(
+                        "output directory escapes its filesystem root: {}",
+                        output_dir.display()
+                    ))
+                })?;
+            }
+            Component::Prefix(_) | Component::RootDir => {
+                return Err(CliError::invalid_input(format!(
+                    "output directory contains an unexpected root component: {}",
+                    output_dir.display()
+                )));
+            }
+        }
+    }
+
+    let mut current = Dir::open_ambient_dir(root_path, ambient_authority())
+        .map_err(|error| extraction_io("failed to open output directory", output_dir, &error))?;
+    for (index, component) in components.iter().enumerate() {
+        current = open_or_create_output_component(&current, component, output_dir, index == 0)?;
+    }
+    Ok(current)
+}
+
 fn parent_entry_is_unsafe(parent: &Dir, name: &OsStr) -> Result<bool, CliError> {
     match parent.symlink_metadata(name) {
         Ok(metadata) => Ok(metadata.file_type().is_symlink() || !metadata.is_dir()),
@@ -1783,21 +1875,15 @@ fn parse_fetch_url(input: &str) -> Result<Url, CliError> {
     Ok(url)
 }
 
-fn fetch_output_dir(output: &Option<PathBuf>) -> Result<PathBuf, CliError> {
+fn fetch_output_dir(output: &Option<PathBuf>) -> Result<(PathBuf, Dir), CliError> {
     let output_dir = match output {
         Some(dir) => dir.clone(),
         None => {
             std::env::current_dir().map_err(|e| CliError::io(format!("cannot get cwd: {e}")))?
         }
     };
-
-    if !output_dir.exists() {
-        fs::create_dir_all(&output_dir).map_err(|e| {
-            CliError::io(format!("failed to create output directory {}: {e}", output_dir.display()))
-        })?;
-    }
-
-    Ok(output_dir)
+    let output_handle = open_or_create_output_dir(&output_dir)?;
+    Ok((output_dir, output_handle))
 }
 
 fn write_fetch_output(
@@ -1968,14 +2054,7 @@ fn cmd_fetch(
     let url = parse_fetch_url(url)?;
     let agent = http_agent();
 
-    let output_dir = fetch_output_dir(output)?;
-    let output_handle =
-        Dir::open_ambient_dir(&output_dir, ambient_authority()).map_err(|error| {
-            CliError::io(format!(
-                "failed to open output directory {}: {error}",
-                output_dir.display()
-            ))
-        })?;
+    let (output_dir, output_handle) = fetch_output_dir(output)?;
     let (bundle_filename, bundle_path, bundle_body, bundle_url) =
         fetch_bundle(&agent, &url, &output_handle, &output_dir, allow_cross_origin)?;
 
@@ -2020,10 +2099,7 @@ fn extract_source_contents(
     sm: &SourceMap,
     output_dir: &Path,
 ) -> Result<(Vec<serde_json::Value>, Vec<String>), CliError> {
-    Dir::create_ambient_dir_all(output_dir, ambient_authority())
-        .map_err(|error| extraction_io("failed to create output directory", output_dir, &error))?;
-    let root = Dir::open_ambient_dir(output_dir, ambient_authority())
-        .map_err(|error| extraction_io("failed to open output directory", output_dir, &error))?;
+    let root = open_or_create_output_dir(output_dir)?;
     let mut extracted = Vec::new();
     let mut skipped = Vec::new();
 

crates/cli/tests/cli.rs

@@ -693,6 +693,65 @@ fn sources_extract_security_skips_existing_destination() {
     assert_eq!(result["skipped"], serde_json::json!(["existing.ts"]));
 }
 
+#[cfg(unix)]
+#[test]
+fn sources_extract_security_rejects_symlink_output_root() {
+    use std::os::unix::fs::symlink;
+
+    let dir = tempfile::tempdir().unwrap();
+    let root = dir.path().canonicalize().unwrap();
+    let outside_dir = root.join("outside");
+    let output_dir = root.join("output");
+    fs::create_dir(&outside_dir).unwrap();
+    symlink(&outside_dir, &output_dir).unwrap();
+    let map = write_sources_map(dir.path(), &["source.ts"]);
+
+    let out = srcmap()
+        .args([
+            "sources",
+            map.to_str().unwrap(),
+            "--extract",
+            "-o",
+            output_dir.to_str().unwrap(),
+            "--json",
+        ])
+        .output()
+        .unwrap();
+
+    assert!(!out.status.success());
+    assert!(!outside_dir.join("source.ts").exists());
+}
+
+#[cfg(unix)]
+#[test]
+fn sources_extract_security_rejects_symlink_output_ancestor() {
+    use std::os::unix::fs::symlink;
+
+    let dir = tempfile::tempdir().unwrap();
+    let root = dir.path().canonicalize().unwrap();
+    let outside_dir = root.join("outside");
+    let linked_dir = root.join("linked");
+    let output_dir = linked_dir.join("nested");
+    fs::create_dir(&outside_dir).unwrap();
+    symlink(&outside_dir, &linked_dir).unwrap();
+    let map = write_sources_map(&root, &["source.ts"]);
+
+    let out = srcmap()
+        .args([
+            "sources",
+            map.to_str().unwrap(),
+            "--extract",
+            "-o",
+            output_dir.to_str().unwrap(),
+            "--json",
+        ])
+        .output()
+        .unwrap();
+
+    assert!(!out.status.success());
+    assert!(!outside_dir.join("nested/source.ts").exists());
+}
+
 #[cfg(unix)]
 #[test]
 fn sources_extract_security_skips_parent_symlink() {
@@ -1028,6 +1087,61 @@ fn fetch_security_rejects_symlink_bundle_destination() {
     assert_eq!(fs::read_to_string(outside.path()).unwrap(), "sentinel");
 }
 
+#[cfg(unix)]
+#[test]
+fn fetch_security_rejects_symlink_output_root() {
+    use std::os::unix::fs::symlink;
+
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let inline = "console.log(1);\n//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9";
+    let reply = response("200 OK", &[], inline);
+    let received = serve_once(listener.try_clone().unwrap(), reply, Duration::ZERO);
+    let dir = tempfile::tempdir().unwrap();
+    let root = dir.path().canonicalize().unwrap();
+    let outside_dir = root.join("outside");
+    let output_dir = root.join("output");
+    fs::create_dir(&outside_dir).unwrap();
+    symlink(&outside_dir, &output_dir).unwrap();
+
+    let out = srcmap()
+        .args(["fetch", &local_url(&listener, "/bundle.js"), "-o"])
+        .arg(&output_dir)
+        .output()
+        .unwrap();
+
+    assert!(received.recv_timeout(Duration::from_millis(100)).is_err());
+    assert!(!out.status.success());
+    assert!(!outside_dir.join("bundle.js").exists());
+}
+
+#[cfg(unix)]
+#[test]
+fn fetch_security_rejects_symlink_output_ancestor() {
+    use std::os::unix::fs::symlink;
+
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let inline = "console.log(1);\n//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9";
+    let reply = response("200 OK", &[], inline);
+    let received = serve_once(listener.try_clone().unwrap(), reply, Duration::ZERO);
+    let dir = tempfile::tempdir().unwrap();
+    let root = dir.path().canonicalize().unwrap();
+    let outside_dir = root.join("outside");
+    let linked_dir = root.join("linked");
+    let output_dir = linked_dir.join("nested");
+    fs::create_dir(&outside_dir).unwrap();
+    symlink(&outside_dir, &linked_dir).unwrap();
+
+    let out = srcmap()
+        .args(["fetch", &local_url(&listener, "/bundle.js"), "-o"])
+        .arg(&output_dir)
+        .output()
+        .unwrap();
+
+    assert!(received.recv_timeout(Duration::from_millis(100)).is_err());
+    assert!(!out.status.success());
+    assert!(!outside_dir.join("nested/bundle.js").exists());
+}
+
 #[cfg(unix)]
 #[test]
 fn fetch_security_rejects_symlink_source_map_destination() {

crates/codec/src/vlq.rs

@@ -41,7 +41,7 @@ const BASE64_DECODE: [u8; 128] = {
 /// Encode a single signed VLQ value directly into the buffer using unchecked writes.
 ///
 /// # Safety
-/// Caller must ensure `out` has exactly [`MAX_VLQ_BYTES`] bytes of spare capacity
+/// Caller must ensure `out` has at least [`MAX_VLQ_BYTES`] bytes of spare capacity
 /// available for this write (`out.capacity() - out.len() >= MAX_VLQ_BYTES`).
 #[inline(always)]
 pub unsafe fn vlq_encode_unchecked(out: &mut Vec<u8>, value: i64) {
@@ -162,7 +162,7 @@ pub fn vlq_decode(input: &[u8], pos: usize) -> Result<(i64, usize), DecodeError>
 /// Encode a single unsigned VLQ value directly into the buffer using unchecked writes.
 ///
 /// # Safety
-/// Caller must ensure `out` has exactly [`MAX_VLQ_BYTES`] bytes of spare capacity
+/// Caller must ensure `out` has at least [`MAX_VLQ_BYTES`] bytes of spare capacity
 /// available for this write (`out.capacity() - out.len() >= MAX_VLQ_BYTES`).
 #[inline(always)]
 pub unsafe fn vlq_encode_unsigned_unchecked(out: &mut Vec<u8>, value: u64) {