fix: additional filesystem checks (#1799)

Release-As: 6.1.2

test/profileManager.test.ts

@@ -11,13 +11,14 @@ import {
   writeProfileFiles,
 } from '../src/profileManager';
 
+vi.mock('node:fs');
+vi.mock('@actions/core');
+
 describe('Profile Manager', {}, () => {
   beforeEach(() => {
     vi.restoreAllMocks();
-    vi.mock('node:fs');
+    vi.clearAllMocks();
     vol.reset();
-    vi.spyOn(core, 'debug').mockImplementation(() => {});
-    vi.spyOn(core, 'info').mockImplementation(() => {});
   });
 
   describe('parseIni', {}, () => {
@@ -721,4 +722,69 @@ describe('Profile Manager', {}, () => {
       );
     });
   });
+
+  describe('symlink hardening', {}, () => {
+    const credsPath = '/home/user/.aws/credentials';
+    const configPath = '/home/user/.aws/config';
+
+    beforeEach(() => {
+      process.env.AWS_SHARED_CREDENTIALS_FILE = credsPath;
+      process.env.AWS_CONFIG_FILE = configPath;
+    });
+
+    it('mergeProfileSection refuses when the credentials path is a symlink and leaves the target unchanged', {}, () => {
+      fs.mkdirSync('/home/user/.aws', { recursive: true });
+      fs.mkdirSync('/etc', { recursive: true });
+      fs.writeFileSync('/etc/passwd', 'root:x:0:0::/root:/bin/sh');
+      fs.symlinkSync('/etc/passwd', credsPath);
+
+      expect(() => mergeProfileSection(credsPath, 'dev', { aws_access_key_id: 'AKIA' }, true)).toThrow(
+        /Refusing .* \(.* symbolic link\)/,
+      );
+      expect(fs.readFileSync('/etc/passwd', 'utf-8')).toBe('root:x:0:0::/root:/bin/sh');
+    });
+
+    it('mergeProfileSection refuses when the config path is a symlink', {}, () => {
+      fs.mkdirSync('/home/user/.aws', { recursive: true });
+      fs.mkdirSync('/etc', { recursive: true });
+      fs.writeFileSync('/etc/sensitive', 'do not overwrite');
+      fs.symlinkSync('/etc/sensitive', configPath);
+
+      expect(() => mergeProfileSection(configPath, 'profile dev', { region: 'us-east-1' }, true)).toThrow(
+        /Refusing .* \(.* symbolic link\)/,
+      );
+      expect(fs.readFileSync('/etc/sensitive', 'utf-8')).toBe('do not overwrite');
+    });
+
+    it('ensureAwsDirectoryExists refuses when ~/.aws is a symlink', {}, () => {
+      fs.mkdirSync('/real-target', { recursive: true });
+      fs.mkdirSync('/home/user', { recursive: true });
+      fs.symlinkSync('/real-target', '/home/user/.aws');
+
+      expect(() => ensureAwsDirectoryExists(credsPath)).toThrow(/Refusing .* \(.* symbolic link\)/);
+    });
+
+    it('writeProfileFiles refuses to overwrite a pre-existing symlink at the credentials path', {}, () => {
+      fs.mkdirSync('/home/user/.aws', { recursive: true });
+      fs.mkdirSync('/etc', { recursive: true });
+      fs.writeFileSync('/etc/passwd', 'root:x:0:0::/root:/bin/sh');
+      fs.symlinkSync('/etc/passwd', credsPath);
+
+      expect(() =>
+        writeProfileFiles('dev', { AccessKeyId: 'AKIA', SecretAccessKey: 'secret' }, 'us-east-1', true),
+      ).toThrow(/Refusing .* \(.* symbolic link\)/);
+
+      expect(fs.lstatSync(credsPath).isSymbolicLink()).toBe(true);
+      expect(fs.readFileSync('/etc/passwd', 'utf-8')).toBe('root:x:0:0::/root:/bin/sh');
+    });
+
+    it('happy path still writes both files with mode 0o600 when no symlinks are present', {}, () => {
+      writeProfileFiles('dev', { AccessKeyId: 'AKIA', SecretAccessKey: 'secret' }, 'us-east-1', false);
+
+      expect(fs.statSync(credsPath).mode & 0o777).toBe(0o600);
+      expect(fs.statSync(configPath).mode & 0o777).toBe(0o600);
+      expect(fs.lstatSync(credsPath).isSymbolicLink()).toBe(false);
+      expect(fs.lstatSync(configPath).isSymbolicLink()).toBe(false);
+    });
+  });
 });