gsadmin/Firelink
1
0
Fork 0
mirror of https://github.com/nimbold/Firelink.git synced 2026-07-26 12:08:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): harden package and engine verifier cleanup

Browse Source
This commit is contained in:
NimBold
2026-07-15 08:40:12 +03:30
parent 1da0fa7223
commit 4a3fece22b
3 changed files with 75 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/verify-linux-packages.js
+10 -2
View File
@@ -96,6 +96,15 @@ export function parseDebianPackagePath(line) {
return match[1].replace(/^\.\//, '');
}
export function isSafePackagePath(packagePath) {
if (packagePath === '') {
return true;
}
const parts = packagePath.split('/');
return !parts.includes('..') && (parts[0] === 'usr' || packagePath === 'usr');
}
function assertSafePackageListing(listing, packageType) {
const lines = listing.split('\n').filter(Boolean);
const paths = packageType === 'deb'
@@ -109,8 +118,7 @@ function assertSafePackageListing(listing, packageType) {
: lines.map(line => line.replace(/^\/+/, ''));
for (const packagePath of paths) {
const parts = packagePath.split('/');
if (parts.includes('..') || (parts[0] !== 'usr' && packagePath !== 'usr')) {
if (!isSafePackagePath(packagePath)) {
fail(`${packageType} package contains an unsafe path: ${packagePath}`);
}
}