fix: Avoid following circular symlinks (#126)

gulpjs · Apr 8, 2024 · cf8b197 · cf8b197
1 parent 4349b07
commit cf8b197
Show file tree

Hide file tree

Showing 7 changed files with 62 additions and 3 deletions.
diff --git a/index.js b/index.js
@@ -24,6 +24,21 @@ function isFound(glob) {
   return isGlob(glob);
 }
 
+function getSymlinkInfo(filepath, cb) {
+  fs.realpath(filepath, function (err, realPath) {
+    if (err) return cb(err);
+
+    fs.lstat(realPath, function (err, lstat) {
+      if (err) return cb(err);
+
+      cb(null, {
+        destinationPath: realPath,
+        destinationStat: lstat,
+      });
+    });
+  });
+}
+
 function walkdir() {
   var readdirOpts = {
     withFileTypes: true,
@@ -114,12 +129,15 @@ function walkdir() {
 
       if (dirent.isSymbolicLink()) {
         // If it's a symlink, check if the symlink points to a directory
-        fs.stat(nextpath, function (err, stats) {
+        getSymlinkInfo(nextpath, function (err, info) {
           if (err) {
             return cb(err);
           }
 
-          if (stats.isDirectory()) {
+          if (
+            info.destinationStat.isDirectory() &&
+            !nextpath.startsWith(info.destinationPath + path.sep) // don't follow circular symlinks
+          ) {
             cb(null, nextpath);
           } else {
             cb();

diff --git a/test/fixtures/symlinks/circular-symlink b/test/fixtures/symlinks/circular-symlink
@@ -0,0 +1 @@
+../../
diff --git a/test/fixtures/symlinks/folder-a/folder-a-file.txt b/test/fixtures/symlinks/folder-a/folder-a-file.txt
@@ -0,0 +1 @@
+hello a
diff --git a/test/fixtures/symlinks/folder-a/link-to-b b/test/fixtures/symlinks/folder-a/link-to-b
@@ -0,0 +1 @@
+../folder-b
diff --git a/test/fixtures/symlinks/folder-b/folder-b-file.txt b/test/fixtures/symlinks/folder-b/folder-b-file.txt
@@ -0,0 +1 @@
+world b
diff --git a/test/fixtures/symlinks/folder-b/link-to-a b/test/fixtures/symlinks/folder-b/link-to-a
@@ -0,0 +1 @@
+../folder-a
diff --git a/test/index.js b/test/index.js
@@ -818,12 +818,48 @@ function suite(moduleName) {
             dir +
             '/fixtures/symlinks/symlink-dest/hey/isaidhey/whatsgoingon/test.txt',
         },
+
+        {
+          cwd: dir,
+          base: dir + '/fixtures/symlinks',
+          path: dir + '/fixtures/symlinks/folder-a/folder-a-file.txt',
+        },
+        {
+          cwd: dir,
+          base: dir + '/fixtures/symlinks',
+          path: dir + '/fixtures/symlinks/folder-b/folder-b-file.txt',
+        },
+
+        // It should follow these circular symlinks, but not infinitely
+        {
+          cwd: dir,
+          base: dir + '/fixtures/symlinks',
+          path: dir + '/fixtures/symlinks/folder-a/link-to-b/folder-b-file.txt',
+        },
+        {
+          cwd: dir,
+          base: dir + '/fixtures/symlinks',
+          path: dir + '/fixtures/symlinks/folder-b/link-to-a/folder-a-file.txt',
+        },
+
+        // And it should follow a symlink to a parent directory (circular symlink) without blowing up
+        {
+          cwd: dir,
+          base: dir + '/fixtures/symlinks',
+          path:
+            dir +
+            '/fixtures/symlinks/symlink-dest/hey/isaidhey/whatsgoingon/test.txt',
+        },
       ];
 
       function assert(pathObjs) {
-        expect(pathObjs.length).toBe(2);
+        expect(pathObjs.length).toBe(6);
         expect(pathObjs).toContainEqual(expected[0]);
         expect(pathObjs).toContainEqual(expected[1]);
+        expect(pathObjs).toContainEqual(expected[2]);
+        expect(pathObjs).toContainEqual(expected[3]);
+        expect(pathObjs).toContainEqual(expected[4]);
+        expect(pathObjs).toContainEqual(expected[5]);
       }
 
       stream.pipeline(