fix: apply slash normalizer before bin path join (#41)

npm · May 2, 2023 · 1ebb83b · 1ebb83b
1 parent 148c452
commit 1ebb83b
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 1 deletion.
diff --git a/lib/index.js b/lib/index.js
@@ -41,7 +41,7 @@ const normalizeObject = pkg => {
       return
     }
 
-    const binTarget = join('/', orig[binKey])
+    const binTarget = join('/', orig[binKey].replace(/\\/g, '/'))
       .replace(/\\/g, '/').slice(1)
 
     if (!binTarget) {

diff --git a/test/array.js b/test/array.js
@@ -39,3 +39,10 @@ t.test('dotty array', async t => {
   t.strictSame(normalize(pkg), expect)
   t.strictSame(normalize(normalize(pkg)), expect, 'double sanitize ok')
 })
+
+t.test('dotty array with backslashes', async t => {
+  const pkg = { name: 'hello', version: 'world', bin: ['..\\..\\..\\..\\etc\\passwd'] }
+  const expect = { name: 'hello', version: 'world', bin: { passwd: 'etc/passwd' } }
+  t.strictSame(normalize(pkg), expect)
+  t.strictSame(normalize(normalize(pkg)), expect, 'double sanitize ok')
+})
diff --git a/test/string.js b/test/string.js
@@ -22,6 +22,13 @@ t.test('dotty string', async t => {
   t.strictSame(normalize(normalize(pkg)), expect, 'double sanitize ok')
 })
 
+t.test('dotty string with backslashes', async t => {
+  const pkg = { name: 'hello', version: 'world', bin: '..\\..\\..\\..\\etc\\passwd' }
+  const expect = { name: 'hello', version: 'world', bin: { hello: 'etc/passwd' } }
+  t.strictSame(normalize(pkg), expect)
+  t.strictSame(normalize(normalize(pkg)), expect, 'double sanitize ok')
+})
+
 t.test('double path', async t => {
   const pkg = { name: 'hello', version: 'world', bin: '/etc/passwd:/bin/usr/exec' }
   const expect = { name: 'hello', version: 'world', bin: { hello: 'etc/passwd:/bin/usr/exec' } }