[pull] main from pingdotgg:main

.github/VOUCHED.td

@@ -25,6 +25,7 @@ github:D3OXY
 github:dbalders
 github:eggfriedrice24
 github:extoci
+github:f-trycua
 github:flamboh
 github:FllipEis
 github:gbarros-dev

.github/scripts/stage-preview-bundle.py

@@ -0,0 +1,76 @@
+"""Stage an untrusted preview ZIP without letting it replace packaging code."""
+
+import shutil
+import stat
+import sys
+import zipfile
+from pathlib import Path
+
+ROOTS = ("server/dist", "desktop/dist-electron")
+REQUIRED_FILES = {
+    "server/dist/bin.mjs",
+    "server/dist/client/index.html",
+    "desktop/dist-electron/main.cjs",
+}
+# The current bundle is about 32 MiB compressed. Bound extraction on the
+# trusted runner even when the PR replaces the uploader entirely.
+MAX_ARCHIVE_BYTES = 512 * 1024 * 1024
+MAX_EXPANDED_BYTES = 2 * 1024 * 1024 * 1024
+MAX_ENTRIES = 50_000
+
+
+def stage_bundle(archive: Path, destination: Path):
+    if archive.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise ValueError("Preview archive is too large")
+    with zipfile.ZipFile(archive) as bundle:
+        entries = bundle.infolist()
+        if len(entries) > MAX_ENTRIES:
+            raise ValueError("Preview archive has too many entries")
+        if sum(entry.file_size for entry in entries) > MAX_EXPANDED_BYTES:
+            raise ValueError("Expanded preview bundle is too large")
+        seen = set()
+        files = set()
+        for entry in entries:
+            name = entry.filename.removesuffix("/")
+            parts = name.split("/")
+            # Reject ambiguous paths before normalization, including names
+            # that would alias on the macOS signing runner.
+            if (
+                entry.orig_filename != entry.filename
+                or any(part in ("", ".", "..") for part in parts)
+                or any(char in name for char in "\\:")
+                or not name.isascii()
+                or any(ord(char) < 32 or ord(char) == 127 for char in name)
+            ):
+                raise ValueError(f"Unsafe preview path: {entry.filename!r}")
+            allowed = any(name.startswith(root + "/") for root in ROOTS)
+            if entry.is_dir():
+                allowed |= any(root == name or root.startswith(name + "/") for root in ROOTS)
+            if not allowed:
+                raise ValueError(f"Unexpected preview path: {name!r}")
+            kind = stat.S_IFMT(entry.external_attr >> 16)
+            if kind not in (0, stat.S_IFDIR if entry.is_dir() else stat.S_IFREG):
+                raise ValueError(f"Non-regular preview entry: {name!r}")
+            if name.casefold() in seen:
+                raise ValueError(f"Duplicate preview path: {name!r}")
+            seen.add(name.casefold())
+            if not entry.is_dir():
+                files.add(name)
+        if not REQUIRED_FILES <= files:
+            raise ValueError("Preview bundle is missing required entry points")
+        # Validate all names before writing anything. This is a fresh directory
+        # outside the checkout; neither pre-existing links nor trusted files
+        # can be followed or overwritten. ZIP permissions are never restored.
+        destination.mkdir(parents=True, exist_ok=False)
+        for entry in entries:
+            target = destination / entry.filename
+            if entry.is_dir():
+                target.mkdir(parents=True, exist_ok=True)
+            else:
+                target.parent.mkdir(parents=True, exist_ok=True)
+                with bundle.open(entry) as source, target.open("xb") as output:
+                    shutil.copyfileobj(source, output)
+
+
+if __name__ == "__main__":
+    stage_bundle(Path(sys.argv[1]), Path(sys.argv[2]))

.github/scripts/stage-preview-bundle.test.py

@@ -0,0 +1,97 @@
+import importlib.util
+import stat
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location(
+    "stage_preview_bundle", Path(__file__).with_name("stage-preview-bundle.py")
+)
+staging = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(staging)
+
+
+class StagePreviewBundleTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.archive = self.root / "bundle.zip"
+        self.destination = self.root / "staged"
+
+    def bundle(self, extra=(), missing=None):
+        with zipfile.ZipFile(self.archive, "w") as bundle:
+            for name in sorted(staging.REQUIRED_FILES - {missing}):
+                bundle.writestr(name, b"bundle data, never executed")
+            for name, content in extra:
+                bundle.writestr(name, content)
+
+    def stage(self):
+        staging.stage_bundle(self.archive, self.destination)
+
+    def test_preserves_valid_bundle_layout_and_bytes(self):
+        self.bundle([("server/", b""), ("server/dist/", b""),
+                     ("desktop/dist-electron/chunks/helper.cjs", b"chunk")])
+        self.stage()
+        for name in staging.REQUIRED_FILES:
+            self.assertEqual((self.destination / name).read_bytes(), b"bundle data, never executed")
+        self.assertEqual((self.destination / "desktop/dist-electron/chunks/helper.cjs").read_bytes(), b"chunk")
+
+    def test_rejects_builder_overwrite_and_unsafe_paths_before_writing(self):
+        for name in [
+            "desktop/node_modules/electron-builder/cli.js",
+            "desktop/package.json",
+            "server/dist/../../desktop/package.json",
+            "../package.json",
+            "/server/dist/absolute",
+            "server/dist/./alias",
+            "server/dist//alias",
+            "server/dist/back\\slash",
+            "server/dist/file:stream",
+            "server/dist/BIN.MJS",
+        ]:
+            with self.subTest(name=name):
+                self.bundle([(name, b"untrusted")])
+                with self.assertRaises(ValueError):
+                    self.stage()
+                self.assertFalse(self.destination.exists())
+
+    def test_rejects_links_and_special_files(self):
+        for mode in [stat.S_IFLNK, stat.S_IFIFO, stat.S_IFCHR]:
+            with self.subTest(mode=mode):
+                entry = zipfile.ZipInfo("server/dist/link")
+                entry.create_system = 3
+                entry.external_attr = (mode | 0o777) << 16
+                self.bundle([(entry, b"../../../desktop/node_modules")])
+                with self.assertRaises(ValueError):
+                    self.stage()
+                self.assertFalse(self.destination.exists())
+
+    def test_requires_entry_points(self):
+        self.bundle(missing="desktop/dist-electron/main.cjs")
+        with self.assertRaises(ValueError):
+            self.stage()
+        self.assertFalse(self.destination.exists())
+
+    def test_bounds_archive_size_expanded_size_and_entry_count(self):
+        for limit in ["MAX_ARCHIVE_BYTES", "MAX_EXPANDED_BYTES", "MAX_ENTRIES"]:
+            with self.subTest(limit=limit), patch.object(staging, limit, 1):
+                self.bundle()
+                with self.assertRaises(ValueError):
+                    self.stage()
+                self.assertFalse(self.destination.exists())
+
+    def test_refuses_existing_destination(self):
+        self.bundle()
+        self.destination.mkdir()
+        sentinel = self.destination / "trusted"
+        sentinel.write_text("untouched")
+        with self.assertRaises(FileExistsError):
+            self.stage()
+        self.assertEqual(sentinel.read_text(), "untouched")
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/workflows/ci.yml

@@ -103,6 +103,9 @@ jobs:
           sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
           sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
 
+      - name: Test preview artifact validation
+        run: python3 -B .github/scripts/stage-preview-bundle.test.py
+
       - name: Test nightly release checks
         run: node --test .github/scripts/check-nightly-release.test.cjs