[Bug]: origRealpath
in fs patch is not the original fs.realpath
#1898
Labels
bug
Something isn't working
origRealpath
in fs patch is not the original fs.realpath
#1898
What happened?
In the fs patch, it's assumed that methods in
fs
is independent, so original fs methods before patched are still accessible:However that's not the case, and it can be easily reproduced via running the following code snippet:
which throws an error:
That indicates that the behaviour of
origRealpath
has been changed as soon asreadlink
got patched! And it can lead to sandbox escape from here.In my case,
origRealpath
returns something in the bazel out directory which is again a symlink, andorigReadlink
later resolves it to something in my source directory.Version
Only nodejs version matters:
How to reproduce
No response
Any other information?
No response
The text was updated successfully, but these errors were encountered: