zwave-js / zwave-js-ui / 27951347502

8%

push

github

fix: prevent symlinks from escaping the store directory (#4678)

The `PUT/POST` `/api/store-multi` endpoints and the backup-restore flow
took user-supplied paths and applied only a string-prefix check, so an
authenticated user could delete or ZIP-export files outside storeDir,
and a restore archive could plant a symlink that escaped `storeDir` to
write arbitrary files. The shared `getSafePath()` helper never resolved
real paths, so symlinked components defeated the confinement.

With this PR, `getSafePath()` now normalizes paths relative to the
`storeDir` and resolves the targets of symlinks, optionally throwing if
a path ends up pointing outside the store.
Also, the restore flow now stages the ZIP file contents, and checks them
for symlinks that would point outside the store, before restoring the
archive.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

417 of 544 branches covered (76.65%)

Branch coverage included in aggregate %.

30 of 113 new or added lines in 3 files covered. (26.55%)

4448 of 25068 relevant lines covered (17.74%)

1.12 hits per line