fix: additional filesystem checks (#1799)

Release-As: 6.1.2

src/assumeRole.ts

@@ -1,11 +1,10 @@
 import assert from 'node:assert';
-import fs from 'node:fs';
 import path from 'node:path';
 import * as core from '@actions/core';
 import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts';
 import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
 import type { CredentialsClient } from './CredentialsClient';
-import { errorMessage, isDefined, sanitizeGitHubVariables } from './helpers';
+import { errorMessage, isDefined, readFileUtf8, sanitizeGitHubVariables } from './helpers';
 
 async function assumeRoleWithOIDC(params: AssumeRoleCommandInput, client: STSClient, webIdentityToken: string) {
   delete params.Tags;
@@ -36,12 +35,12 @@ async function assumeRoleWithWebIdentityTokenFile(
   const webIdentityTokenFilePath = path.isAbsolute(webIdentityTokenFile)
     ? webIdentityTokenFile
     : path.join(workspace, webIdentityTokenFile);
-  if (!fs.existsSync(webIdentityTokenFilePath)) {
+  const webIdentityToken = readFileUtf8(webIdentityTokenFilePath);
+  if (webIdentityToken === null) {
     throw new Error(`Web identity token file does not exist: ${webIdentityTokenFilePath}`);
   }
   core.info('Assuming role with web identity token file');
   try {
-    const webIdentityToken = fs.readFileSync(webIdentityTokenFilePath, 'utf8');
     delete params.Tags;
     const creds = await client.send(
       new AssumeRoleWithWebIdentityCommand({

src/helpers.ts

@@ -1,3 +1,5 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 import * as core from '@actions/core';
 import type { Credentials, STSClient } from '@aws-sdk/client-sts';
 import { GetCallerIdentityCommand } from '@aws-sdk/client-sts';
@@ -268,3 +270,88 @@ export function getBooleanInput(name: string, options?: core.InputOptions & { de
       `Support boolean input list: \`true | True | TRUE | false | False | FALSE\``,
   );
 }
+
+// O_NOFOLLOW is undefined on Windows. This sets it to 0 if it's not defined.
+const O_NOFOLLOW: number = (fs.constants as { O_NOFOLLOW?: number }).O_NOFOLLOW ?? 0;
+
+export function isSymlink(filePath: string): boolean {
+  try {
+    return fs.lstatSync(filePath).isSymbolicLink();
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return false;
+    throw err;
+  }
+}
+
+// Refuses if filePath or its parent directory is a symbolic link.
+function refuseSymlinkOnPath(filePath: string): void {
+  const parent = path.dirname(filePath);
+  if (parent !== filePath && isSymlink(parent)) {
+    throw new Error(`Refusing ${filePath} (parent directory is a symbolic link)`);
+  }
+  if (isSymlink(filePath)) {
+    throw new Error(`Refusing ${filePath} (path is a symbolic link)`);
+  }
+}
+
+function assertRegularFile(fd: number, filePath: string): void {
+  const stats = fs.fstatSync(fd);
+  if (!stats.isFile()) {
+    throw new Error(`${filePath} (path is not a regular file)`);
+  }
+}
+
+// ENOENT: file does not exist
+// ELOOP: too many symbolic links (from NOFOLLOW)
+
+export function readFileUtf8(filePath: string): string | null {
+  refuseSymlinkOnPath(filePath);
+  let fd: number;
+  try {
+    fd = fs.openSync(filePath, fs.constants.O_RDONLY | O_NOFOLLOW);
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === 'ENOENT') return null;
+    if (code === 'ELOOP') {
+      throw new Error(`Refusing ${filePath} (path is a symbolic link)`);
+    }
+    throw err;
+  }
+  try {
+    assertRegularFile(fd, filePath);
+    return fs.readFileSync(fd, 'utf-8');
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+export function writeFileUtf8(filePath: string, content: string, mode = 0o600): void {
+  refuseSymlinkOnPath(filePath);
+  let fd: number;
+  try {
+    fd = fs.openSync(filePath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | O_NOFOLLOW, mode);
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === 'ELOOP') {
+      throw new Error(`Refusing ${filePath} (path is a symbolic link)`);
+    }
+    throw err;
+  }
+  try {
+    assertRegularFile(fd, filePath);
+    // openSync only applies mode on creation.
+    // If the file already exists, we need to ensure the mode is correct.
+    if (process.platform !== 'win32') {
+      fs.fchmodSync(fd, mode);
+    }
+    fs.writeFileSync(fd, content);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+export function mkdir(dir: string, mode = 0o700): void {
+  fs.mkdirSync(dir, { recursive: true, mode });
+  if (isSymlink(dir)) {
+    throw new Error(`Refusing ${dir} (path is a symbolic link)`);
+  }
+}

src/profileManager.ts

@@ -1,8 +1,8 @@
-import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import * as core from '@actions/core';
 import type { Credentials } from '@aws-sdk/client-sts';
+import { mkdir, readFileUtf8, writeFileUtf8 } from './helpers';
 
 /**
  * Parse an INI-format string into a nested object.
@@ -87,10 +87,8 @@ export function getProfileFilePaths(): ProfileFilePaths {
  */
 export function ensureAwsDirectoryExists(filePath: string): void {
   const dir = path.dirname(filePath);
-  if (!fs.existsSync(dir)) {
-    core.debug(`Creating directory: ${dir}`);
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  }
+  core.debug(`Ensuring directory exists: ${dir}`);
+  mkdir(dir, 0o700);
 }
 
 /**
@@ -127,14 +125,8 @@ export function mergeProfileSection(
   data: Record<string, string>,
   overwriteAwsProfile: boolean,
 ): void {
-  let existingContent: Record<string, Record<string, string>> = {};
-
-  // Read existing file if it exists
-  if (fs.existsSync(filePath)) {
-    core.debug(`Reading existing file: ${filePath}`);
-    const fileContent = fs.readFileSync(filePath, 'utf-8');
-    existingContent = parseIni(fileContent);
-  }
+  const fileContent = readFileUtf8(filePath);
+  const existingContent: Record<string, Record<string, string>> = fileContent === null ? {} : parseIni(fileContent);
 
   if (existingContent[sectionName] && !overwriteAwsProfile) {
     throw new Error(
@@ -147,7 +139,7 @@ export function mergeProfileSection(
   const content = stringifyIni(existingContent);
 
   core.debug(`Writing profile to ${filePath}`);
-  fs.writeFileSync(filePath, content, { mode: 0o600 });
+  writeFileUtf8(filePath, content, 0o600);
 }
 
 /**