[BUG] Some git commands are executed under destination directory's owner account #14

x-yuri · 2019-10-31T14:36:16Z

What / Why

It might so happen that root installs packages into a directory owned by another user. Consider a case where you launch an app with docker-compose and bind mount the host directory with source code (.) into the container (/app) for changes to source code to automatically propagate into the container. Under this circumstances we get root user and /app owned by uid 1000. During fetch-package-metadata phase it succeeds, since nothing says it has to impersonate:

pacote@9.5.5 started to run commands under cwd's owner. But some files are to be created in ~/.npm/_cacache/tmp (e.g. cloning repositories when installing from github). When a process (npm) user doesn't match the cwd user, process user's cache is still used. So git clone is executed under cwd user to clone to the process user's tmp dir, which apparently fails. That can happen under docker when a non-root's directory is bind-mounted into a container. It's not owned by root in the container either, but the processes in the container are running under root (unless explicitly started as another user).

The issue doesn't reveal itself on the fetch-package-metadata phase:

https://github.com/npm/cli/blob/v6.12.1/lib/fetch-package-metadata.js#L59-L65
https://github.com/npm/pacote/blob/v9.5.8/manifest.js#L25
https://github.com/npm/pacote/blob/v9.5.8/lib/finalize-manifest.js#L49
https://github.com/npm/pacote/blob/v9.5.8/lib/finalize-manifest.js#L154
https://github.com/npm/pacote/blob/v9.5.8/lib/fetch.js#L33
https://github.com/npm/pacote/blob/v9.5.8/lib/fetchers/git.js#L71-L73
https://github.com/npm/pacote/blob/v9.5.8/lib/fetchers/git.js#L176

But on the extract phase it switches to non-root and fails:

https://github.com/npm/cli/blob/v6.12.1/lib/install/action/extract.js#L90
https://github.com/npm/pacote/blob/v9.5.8/extract.js#L42
https://github.com/npm/pacote/blob/v9.5.8/lib/with-tarball-stream.js#L96
https://github.com/npm/pacote/blob/v9.5.8/lib/fetch.js#L28
https://github.com/npm/pacote/blob/v9.5.8/lib/fetchers/git.js#L44
https://github.com/npm/pacote/blob/v9.5.8/lib/fetchers/git.js#L71-L73
https://github.com/npm/pacote/blob/v9.5.8/lib/fetchers/git.js#L176

When

When installing packages from GitHub.

Where

n/a

How

Current Behavior

An error occurs:

npm ERR! code 128
npm ERR! Command failed: git clone --mirror -q git://github.com/kevva/is-positive.git /root/.npm/_cacache/tmp/git-clone-d80b8730/.git
npm ERR! fatal: could not create leading directories of '/root/.npm/_cacache/tmp/git-clone-d80b8730/.git'

Steps to Reproduce

Under non-root user:

1.sh:

#!/bin/sh
set -eux
npm --version
apk add git
npm i kevva/is-positive || cat /root/.npm/_logs/*.log

$ docker run --rm -itv $PWD:/app -w /app node:10.17.0-alpine3.10 ./1.sh
+ npm --version
6.11.3
...
+ npm i kevva/is-positive
...
npm ERR! Command failed: git clone --mirror -q git://github.com/kevva/is-positive.git /root/.npm/_cac
ache/tmp/git-clone-87fa5e82/.git
npm ERR! fatal: could not create leading directories of '/root/.npm/_cacache/tmp/git-clone-87fa5e82/.
git'
...

Or under root in a non-root dir:

$ npm i kevva/is-positive

Expected Behavior

It either succeeds in both cases (extract, fetch-package-metadata), or fails. Preferably the former.

Who

n/a

References

Related to Infer ownership of _all_ unpacked files (like cacache does for cache) #2

More info

Introduced in npm-6.11.0, pacote-9.5.5. Fixed in npm-6.13.6, pacote-9.5.12.
Affects node@^10.17.0 (npm-6.11.3), node >= 12.11.0 (npm-6.11.3), node < 13.7.0 (npm-6.13.6). More on it here.

Old steps to reproduce

Create files based on the following gist and do docker-compose up:

docker-compose.yml:

version: '3'

services:
  app:
    build: .
    # entrypoint: sleep 10000000
    # ports:
      # - 9229:9229
    volumes:
      - ./:/app

Dockerfile:

FROM node:12.13.0-alpine

RUN apk add git vim
WORKDIR /app

ENTRYPOINT ["./entrypoint.sh"]

entrypoint.sh:

#!/bin/sh
set -eu
npm i || true
cat /root/.npm/_logs/*.log

$ chmod u+x entrypoint.sh
$ docker-compose up

As you might guess the issue was discovered in a docker container. Alternatively,

# useradd -m u1
# cd /home/u1
# echo '{"dependencies": {"is-positive": "kevva/is-positive"}}' > package.json
# npm i

The text was updated successfully, but these errors were encountered:

isaacs · 2019-12-04T20:32:51Z

Fixed in 9.5.10 and 10.2.1.

9.5.10 will be included in the next npm v6 release. 10.2.1 (or some later v10) will be included in npm v7.

Bumps [npm](https://github.com/npm/cli) from 6.10.1 to 6.13.4. **This update includes security fixes.** <details> <summary>Vulnerabilities fixed</summary> *Sourced from The GitHub Security Advisory Database.* > **Low severity vulnerability that affects npm** > ## Unauthorized File Access > > Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. > > This behavior is possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. > > Thank you Daniel Ruf for responsibly reporting the issue! > > Further information: [npm blog post](https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli) > > Affected versions: < 6.13.3 *Sourced from The GitHub Security Advisory Database.* > **Low severity vulnerability that affects npm** > ## Arbitrary File Write > > Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended `node_modules` folder through the `bin` field. A properly constructed entry in the package.json `bin` field would allow a package publisher to modify and/or gain access to arbitrary files on a user’s system when the package is installed. > > This behavior is possible through install scripts. This vulnerability bypasses a user using the `--ignore-scripts` install option. > > Thank you Daniel Ruf for reporting the issue! > > Further information: [npm blog post](https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli) > > Affected versions: < 6.13.3 *Sourced from The GitHub Security Advisory Database.* > **Low severity vulnerability that affects npm** > ## Arbitrary File Overwrite > > Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the previous `serve` binary. > > This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. > > Thank you to Daniel Ruf for reporting the issue! > > Further information: [npm blog post](https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli) > > Affected versions: < 6.13.4 </details> <details> <summary>Release notes</summary> *Sourced from [npm's releases](https://github.com/npm/cli/releases).* > ## v6.13.4 > ## 6.13.4 (2019-12-11) > > ## BUGFIXES > > * [`320ac9aee`](npm/cli@320ac9a) [npm/bin-links#12](https://github-redirect.dependabot.com/npm/bin-links/pull/12) [npm/gentle-fs#7](https://github-redirect.dependabot.com/npm/gentle-fs/pull/7) Do not remove global bin/man links inappropriately ([@isaacs](https://github.com/isaacs)) > > ## DEPENDENCIES > > * [`52fd21061`](npm/cli@52fd210) `gentle-fs@2.3.0` ([@isaacs](https://github.com/isaacs)) > * [`d06f5c0b0`](npm/cli@d06f5c0) `bin-links@1.1.6` ([@isaacs](https://github.com/isaacs)) > > ## v6.13.3 > ## 6.13.3 (2019-12-09) > > ### DEPENDENCIES > > * [`19ce061a2`](npm/cli@19ce061) `bin-links@1.1.5` Properly normalize, sanitize, and verify `bin` entries in `package.json`. > * [`59c836aae`](npm/cli@59c836a) `npm-packlist@1.4.7` > * [`fb4ecd7d2`](npm/cli@fb4ecd7) `pacote@9.5.11` > * [`5f33040`](npm/pacote@5f33040) [#476](https://github-redirect.dependabot.com/npm/cli/issues/476) [npm/pacote#22](https://github-redirect.dependabot.com/npm/pacote/issues/22) [npm/pacote#14](https://github-redirect.dependabot.com/npm/pacote/issues/14) fix: Do not drop perms in git when not root ([isaacs](https://github.com/isaacs), [@darcyclarke](https://github.com/darcyclarke)) > * [`6f229f7`](https://github.com/npm/pacote/6f229f78d9911b4734f0a19c6afdc5454034c759) sanitize and normalize package bin field ([isaacs](https://github.com/isaacs)) > * [`1743cb339`](npm/cli@1743cb3) `read-package-json@2.1.1` > > ## v6.13.2 > ## 6.13.2 (2019-12-03) > > ### BUG FIXES > > * [`4429645b3`](npm/cli@4429645) [#546](https://github-redirect.dependabot.com/npm/cli/pull/546) fix docs target typo ([@richardlau](https://github.com/richardlau)) > * [`867642942`](npm/cli@8676429) [#142](https://github-redirect.dependabot.com/npm/cli/pull/142) fix(packageRelativePath): fix 'where' for file deps ([@larsgw](https://github.com/larsgw)) > * [`d480f2c17`](npm/cli@d480f2c) [#527](https://github-redirect.dependabot.com/npm/cli/pull/527) Revert "windows: Add preliminary WSL support for npm and npx" ([@craigloewen-msft](https://github.com/craigloewen-msft)) > * [`e4b97962e`](npm/cli@e4b9796) [#504](https://github-redirect.dependabot.com/npm/cli/pull/504) remove unnecessary package.json read when reading shrinkwrap ([@Lighting-Jack](https://github.com/Lighting-Jack)) > * [`1c65d26ac`](npm/cli@1c65d26) [#501](https://github-redirect.dependabot.com/npm/cli/pull/501) fix(fund): open url for string shorthand ([@ruyadorno](https://github.com/ruyadorno)) > * [`ae7afe565`](npm/cli@ae7afe5) [#263](https://github-redirect.dependabot.com/npm/cli/pull/263) Don't log error message if git tagging is disabled ([@woppa684](https://github.com/woppa684)) > * [`4c1b16f6a`](npm/cli@4c1b16f) [#182](https://github-redirect.dependabot.com/npm/cli/pull/182) Warn the user that it is uninstalling npm-install ([@Hoidberg](https://github.com/Hoidberg)) > > ## v6.13.1 > ## 6.13.1 (2019-11-18) > > ### BUG FIXES > > * [`938d6124d`](npm/cli@938d612) [#472](https://github-redirect.dependabot.com/npm/cli/pull/472) fix(fund): support funding string shorthand ([@ruyadorno](https://github.com/ruyadorno)) > * [`b49c5535b`](npm/cli@b49c553) [#471](https://github-redirect.dependabot.com/npm/cli/pull/471) should not publish tap-snapshot folder ([@ruyadorno](https://github.com/ruyadorno)) > * [`3471d5200`](npm/cli@3471d52) [#253](https://github-redirect.dependabot.com/npm/cli/pull/253) Add preliminary WSL support for npm and npx ([@infinnie](https://github.com/infinnie)) > * [`3ef295f23`](npm/cli@3ef295f) [#486](https://github-redirect.dependabot.com/npm/cli/pull/486) print quick audit report for human output ([@isaacs](https://github.com/isaacs)) > > ### TESTING > > * [`dbbf977ac`](npm/cli@dbbf977) [#278](https://github-redirect.dependabot.com/npm/cli/pull/278) added workflow to trigger and run benchmarks ([@mikemimik](https://github.com/mikemimik)) ></tr></table> ... (truncated) </details> <details> <summary>Changelog</summary> *Sourced from [npm's changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md).* > ## 6.13.4 (2019-12-11) > > ## BUGFIXES > > * [`320ac9aee`](npm/cli@320ac9a) > [npm/bin-links#12](https://github-redirect.dependabot.com/npm/bin-links/pull/12) > [npm/gentle-fs#7](https://github-redirect.dependabot.com/npm/gentle-fs/pull/7) > Do not remove global bin/man links inappropriately > ([@isaacs](https://github.com/isaacs)) > > ## DEPENDENCIES > > * [`52fd21061`](npm/cli@52fd210) > `gentle-fs@2.3.0` > ([@isaacs](https://github.com/isaacs)) > * [`d06f5c0b0`](npm/cli@d06f5c0) > `bin-links@1.1.6` > ([@isaacs](https://github.com/isaacs)) > > ## 6.13.3 (2019-12-09) > > ### DEPENDENCIES > > * [`19ce061a2`](npm/cli@19ce061) > `bin-links@1.1.5` Properly normalize, sanitize, and verify `bin` entries > in `package.json`. > * [`59c836aae`](npm/cli@59c836a) > `npm-packlist@1.4.7` > * [`fb4ecd7d2`](npm/cli@fb4ecd7) > `pacote@9.5.11` > * [`5f33040`](npm/pacote@5f33040) > [#476](https://github-redirect.dependabot.com/npm/cli/issues/476) > [npm/pacote#22](https://github-redirect.dependabot.com/npm/pacote/issues/22) > [npm/pacote#14](https://github-redirect.dependabot.com/npm/pacote/issues/14) fix: Do not > drop perms in git when not root ([isaacs](https://github.com/isaacs), > [@darcyclarke](https://github.com/darcyclarke)) > * [`6f229f7`](https://github.com/npm/pacote/6f229f78d9911b4734f0a19c6afdc5454034c759) > sanitize and normalize package bin field > ([isaacs](https://github.com/isaacs)) > * [`1743cb339`](npm/cli@1743cb3) > `read-package-json@2.1.1` > > > ## 6.13.2 (2019-12-03) > > ### BUG FIXES > > * [`4429645b3`](npm/cli@4429645) > [#546](https://github-redirect.dependabot.com/npm/cli/pull/546) > fix docs target typo ></tr></table> ... (truncated) </details> <details> <summary>Commits</summary> - [`fd29398`](npm/cli@fd29398) 6.13.4 - [`f2aca36`](npm/cli@f2aca36) docs: changelog for 6.13.4 - [`320ac9a`](npm/cli@320ac9a) Do not remove global bin/man links inappropriately - [`d06f5c0`](npm/cli@d06f5c0) bin-links@1.1.6 - [`52fd210`](npm/cli@52fd210) gentle-fs@2.3.0 - [`45482c2`](npm/cli@45482c2) 6.13.3 - [`118bc96`](npm/cli@118bc96) docs: changelog for 6.13.3 - [`1743cb3`](npm/cli@1743cb3) read-package-json@2.1.1 - [`fb4ecd7`](npm/cli@fb4ecd7) pacote@9.5.11 - [`59c836a`](npm/cli@59c836a) npm-packlist@1.4.7 - Additional commits viewable in [compare view](npm/cli@v6.10.1...v6.13.4) </details> <br /> [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=npm&package-manager=npm_and_yarn&previous-version=6.10.1&new-version=6.13.4)](https://dependabot.com/compatibility-score.html?dependency-name=npm&package-manager=npm_and_yarn&previous-version=6.10.1&new-version=6.13.4) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details>

Summary: Bumps [npm](https://github.com/npm/cli) from 6.5.0 to 6.13.4. <details> <summary>Release notes</summary> *Sourced from [npm's releases](https://github.com/npm/cli/releases).* > ## v6.13.4 > ## 6.13.4 (2019-12-11) > > ## BUGFIXES > > * [`320ac9aee`](npm/cli@320ac9a) [npm/bin-links#12](https://github-redirect.dependabot.com/npm/bin-links/pull/12) [npm/gentle-fs#7](https://github-redirect.dependabot.com/npm/gentle-fs/pull/7) Do not remove global bin/man links inappropriately ([@isaacs](https://github.com/isaacs)) > > ## DEPENDENCIES > > * [`52fd21061`](npm/cli@52fd210) `gentle-fs@2.3.0` ([@isaacs](https://github.com/isaacs)) > * [`d06f5c0b0`](npm/cli@d06f5c0) `bin-links@1.1.6` ([@isaacs](https://github.com/isaacs)) > > ## v6.13.3 > ## 6.13.3 (2019-12-09) > > ### DEPENDENCIES > > * [`19ce061a2`](npm/cli@19ce061) `bin-links@1.1.5` Properly normalize, sanitize, and verify `bin` entries in `package.json`. > * [`59c836aae`](npm/cli@59c836a) `npm-packlist@1.4.7` > * [`fb4ecd7d2`](npm/cli@fb4ecd7) `pacote@9.5.11` > * [`5f33040`](npm/pacote@5f33040) [#476](https://github-redirect.dependabot.com/npm/cli/issues/476) [npm/pacote#22](https://github-redirect.dependabot.com/npm/pacote/issues/22) [npm/pacote#14](https://github-redirect.dependabot.com/npm/pacote/issues/14) fix: Do not drop perms in git when not root ([isaacs](https://github.com/isaacs), [@darcyclarke](https://github.com/darcyclarke)) > * [`6f229f7`](https://github.com/npm/pacote/6f229f78d9911b4734f0a19c6afdc5454034c759) sanitize and normalize package bin field ([isaacs](https://github.com/isaacs)) > * [`1743cb339`](npm/cli@1743cb3) `read-package-json@2.1.1` > > ## v6.13.2 > ## 6.13.2 (2019-12-03) > > ### BUG FIXES > > * [`4429645b3`](npm/cli@4429645) [#546](https://github-redirect.dependabot.com/npm/cli/pull/546) fix docs target typo ([@richardlau](https://github.com/richardlau)) > * [`867642942`](npm/cli@8676429) [#142](https://github-redirect.dependabot.com/npm/cli/pull/142) fix(packageRelativePath): fix 'where' for file deps ([@larsgw](https://github.com/larsgw)) > * [`d480f2c17`](npm/cli@d480f2c) [#527](https://github-redirect.dependabot.com/npm/cli/pull/527) Revert "windows: Add preliminary WSL support for npm and npx" ([@craigloewen-msft](https://github.com/craigloewen-msft)) > * [`e4b97962e`](npm/cli@e4b9796) [#504](https://github-redirect.dependabot.com/npm/cli/pull/504) remove unnecessary package.json read when reading shrinkwrap ([@Lighting-Jack](https://github.com/Lighting-Jack)) > * [`1c65d26ac`](npm/cli@1c65d26) [#501](https://github-redirect.dependabot.com/npm/cli/pull/501) fix(fund): open url for string shorthand ([@ruyadorno](https://github.com/ruyadorno)) > * [`ae7afe565`](npm/cli@ae7afe5) [#263](https://github-redirect.dependabot.com/npm/cli/pull/263) Don't log error message if git tagging is disabled ([@woppa684](https://github.com/woppa684)) > * [`4c1b16f6a`](npm/cli@4c1b16f) [#182](https://github-redirect.dependabot.com/npm/cli/pull/182) Warn the user that it is uninstalling npm-install ([@Hoidberg](https://github.com/Hoidberg)) > > ## v6.13.1 > ## 6.13.1 (2019-11-18) > > ### BUG FIXES > > * [`938d6124d`](npm/cli@938d612) [#472](https://github-redirect.dependabot.com/npm/cli/pull/472) fix(fund): support funding string shorthand ([@ruyadorno](https://github.com/ruyadorno)) > * [`b49c5535b`](npm/cli@b49c553) [#471](https://github-redirect.dependabot.com/npm/cli/pull/471) should not publish tap-snapshot folder ([@ruyadorno](https://github.com/ruyadorno)) > * [`3471d5200`](npm/cli@3471d52) [#253](https://github-redirect.dependabot.com/npm/cli/pull/253) Add preliminary WSL support for npm and npx ([@infinnie](https://github.com/infinnie)) > * [`3ef295f23`](npm/cli@3ef295f) [#486](https://github-redirect.dependabot.com/npm/cli/pull/486) print quick audit report for human output ([@isaacs](https://github.com/isaacs)) > > ### TESTING > > * [`dbbf977ac`](npm/cli@dbbf977) [#278](https://github-redirect.dependabot.com/npm/cli/pull/278) added workflow to trigger and run benchmarks ([@mikemimik](https://github.com/mikemimik)) ></tr></table> ... (truncated) </details> <details> <summary>Changelog</summary> *Sourced from [npm's changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md).* > ## 6.13.4 (2019-12-11) > > ## BUGFIXES > > * [`320ac9aee`](npm/cli@320ac9a) > [npm/bin-links#12](https://github-redirect.dependabot.com/npm/bin-links/pull/12) > [npm/gentle-fs#7](https://github-redirect.dependabot.com/npm/gentle-fs/pull/7) > Do not remove global bin/man links inappropriately > ([@isaacs](https://github.com/isaacs)) > > ## DEPENDENCIES > > * [`52fd21061`](npm/cli@52fd210) > `gentle-fs@2.3.0` > ([@isaacs](https://github.com/isaacs)) > * [`d06f5c0b0`](npm/cli@d06f5c0) > `bin-links@1.1.6` > ([@isaacs](https://github.com/isaacs)) > > ## 6.13.3 (2019-12-09) > > ### DEPENDENCIES > > * [`19ce061a2`](npm/cli@19ce061) > `bin-links@1.1.5` Properly normalize, sanitize, and verify `bin` entries > in `package.json`. > * [`59c836aae`](npm/cli@59c836a) > `npm-packlist@1.4.7` > * [`fb4ecd7d2`](npm/cli@fb4ecd7) > `pacote@9.5.11` > * [`5f33040`](npm/pacote@5f33040) > [#476](https://github-redirect.dependabot.com/npm/cli/issues/476) > [npm/pacote#22](https://github-redirect.dependabot.com/npm/pacote/issues/22) > [npm/pacote#14](https://github-redirect.dependabot.com/npm/pacote/issues/14) fix: Do not > drop perms in git when not root ([isaacs](https://github.com/isaacs), > [@darcyclarke](https://github.com/darcyclarke)) > * [`6f229f7`](https://github.com/npm/pacote/6f229f78d9911b4734f0a19c6afdc5454034c759) > sanitize and normalize package bin field > ([isaacs](https://github.com/isaacs)) > * [`1743cb339`](npm/cli@1743cb3) > `read-package-json@2.1.1` > > > ## 6.13.2 (2019-12-03) > > ### BUG FIXES > > * [`4429645b3`](npm/cli@4429645) > [#546](https://github-redirect.dependabot.com/npm/cli/pull/546) > fix docs target typo ></tr></table> ... (truncated) </details> <details> <summary>Commits</summary> - [`fd29398`](npm/cli@fd29398) 6.13.4 - [`f2aca36`](npm/cli@f2aca36) docs: changelog for 6.13.4 - [`320ac9a`](npm/cli@320ac9a) Do not remove global bin/man links inappropriately - [`d06f5c0`](npm/cli@d06f5c0) bin-links@1.1.6 - [`52fd210`](npm/cli@52fd210) gentle-fs@2.3.0 - [`45482c2`](npm/cli@45482c2) 6.13.3 - [`118bc96`](npm/cli@118bc96) docs: changelog for 6.13.3 - [`1743cb3`](npm/cli@1743cb3) read-package-json@2.1.1 - [`fb4ecd7`](npm/cli@fb4ecd7) pacote@9.5.11 - [`59c836a`](npm/cli@59c836a) npm-packlist@1.4.7 - Additional commits viewable in [compare view](npm/cli@v6.5.0...v6.13.4) </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=npm&package-manager=npm_and_yarn&previous-version=6.5.0&new-version=6.13.4)](https://help.github.com/articles/configuring-automated-security-fixes) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `dependabot rebase` will rebase this PR - `dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `dependabot merge` will merge this PR after your CI passes on it - `dependabot squash and merge` will squash and merge this PR after your CI passes on it - `dependabot cancel merge` will cancel a previously requested merge and block automerging - `dependabot reopen` will reopen this PR if it is closed - `dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebookincubator/fbt/network/alerts). </details> Pull Request resolved: #118 Differential Revision: D19040068 Pulled By: jrwats fbshipit-source-id: cc84fde571d6a3256c65aa959d380a5069f2e419

@isaacs

This fixes some security vulnerabilites, among them an arbitrary file overwrite. The output of `npm audit` goes from this: found 17 vulnerabilities (15 low, 2 high) in 13344 scanned packages run `npm audit fix` to fix 6 of them. 1 vulnerability requires semver-major dependency updates. 10 vulnerabilities require manual review. See the full report for details. To this: found 5 vulnerabilities (3 low, 2 high) in 13370 scanned packages 1 vulnerability requires semver-major dependency updates. 4 vulnerabilities require manual review. See the full report for details. Changelog: - https://github.com/npm/cli/releases 6.13.4 (2019-12-11) BUGFIXES 320ac9aee npm/bin-links#12 npm/gentle-fs#7 Do not remove global bin/man links inappropriately (@isaacs) DEPENDENCIES 52fd21061 gentle-fs@2.3.0 (@isaacs) d06f5c0b0 bin-links@1.1.6 (@isaacs) 6.13.3 (2019-12-09) DEPENDENCIES 19ce061a2 bin-links@1.1.5 Properly normalize, sanitize, and verify bin entries in package.json. 59c836aae npm-packlist@1.4.7 fb4ecd7d2 pacote@9.5.11 5f33040 #476 npm/pacote#22 npm/pacote#14 fix: Do not drop perms in git when not root (isaacs, @darcyclarke) 6f229f7 sanitize and normalize package bin field (isaacs) 1743cb339 read-package-json@2.1.1 6.13.2 (2019-12-03) BUG FIXES 4429645b3 #546 fix docs target typo (@richardlau) 867642942 #142 fix(packageRelativePath): fix 'where' for file deps (@larsgw) d480f2c17 #527 Revert "windows: Add preliminary WSL support for npm and npx" (@craigloewen-msft) e4b97962e #504 remove unnecessary package.json read when reading shrinkwrap (@Lighting-Jack) 1c65d26ac #501 fix(fund): open url for string shorthand (@ruyadorno) ae7afe565 #263 Don't log error message if git tagging is disabled (@woppa684) 4c1b16f6a #182 Warn the user that it is uninstalling npm-install (@Hoidberg)

x-yuri · 2020-02-24T22:14:46Z

I've improved the description since it was pretty bad. And wanted to add that the following commit doesn't solve the issue, because it's not that a non-root tries to switch users, but that root switches users when it shouldn't. The decision must depend on where the files are to be created. Which is handled by the following commit. So supposedly this issue doesn't affect pacote@10.x.

It was fixed in npm-6.13.6, pacote-9.5.12. It was resolved in nodejs >= 13.7.0 (npm >= 6.13.6), but not in nodejs 10, nodejs 12 yet. But updating npm should resolve the issue where it exists by default.

isaacs · 2020-02-26T05:02:48Z

@x-yuri So, iiuc, it is fixed, just not in the commit that we thought fixed it?

x-yuri · 2020-02-26T10:35:41Z

Yes, it is fixed in pacote@9.5.12 (not in 9.5.10 as you most likely supposed). And judging from the related issue, it's not an issue in pacote@10.x. Although I didn't try to confirm the latter.

isaacs closed this as completed Dec 4, 2019

This was referenced Dec 10, 2019

Release v6.13.3 npm/cli#577

Merged

deps: upgrade npm to 6.13.3 nodejs/node#30873

Closed

This was referenced Dec 18, 2019

[Snyk] Upgrade npm from 6.2.0 to 6.13.3 restinpeaceinout/atom#84

Open

[Snyk] Upgrade npm from 6.2.0 to 6.13.4 restinpeaceinout/atom#87

Open

snyk-bot mentioned this issue Jan 7, 2020

[Snyk] Upgrade npm from 6.10.3 to 6.13.4 srdjan-19/rent-a-car-service#4

Open

This was referenced Jan 17, 2020

[Snyk] Upgrade npm from 6.8.0 to 6.13.4 silver-xu/yame-ui#8

Open

[Snyk] Upgrade npm from 6.2.0 to 6.13.6 restinpeaceinout/atom#102

Open

snyk-bot mentioned this issue Feb 11, 2020

[Snyk] Upgrade npm from 6.13.1 to 6.13.6 codeztech-atique/Meanstack-Crud-Frontend-Application#4

Open

snyk-bot mentioned this issue Feb 25, 2020

[Snyk] Upgrade npm from 6.4.1 to 6.13.7 ali8889/etherwallet#10

Open

snyk-bot mentioned this issue Feb 27, 2020

[Snyk] Upgrade npm from 6.2.0 to 6.13.7 restinpeaceinout/atom#124

Open

This was referenced Mar 10, 2020

[Snyk] Upgrade npm from 6.11.2 to 6.14.2 Hypnos3/RedMatic#4

Open

[Snyk] Upgrade npm from 6.2.0 to 6.13.7 xalpinistx/ExpressProject#6

Merged

snyk-bot mentioned this issue Apr 11, 2020

[Snyk] Upgrade npm from 6.4.1 to 6.14.3 ali8889/etherwallet#15

Open

This was referenced Apr 12, 2020

[Snyk] Upgrade npm from 6.2.0 to 6.14.3 restinpeaceinout/atom#180

Open

[Snyk] Upgrade npm from 6.4.1 to 6.14.4 ali8889/etherwallet#17

Open

[Snyk] Upgrade npm from 6.2.0 to 6.14.4 restinpeaceinout/atom#186

Open

snyk-bot mentioned this issue Apr 22, 2020

[Snyk] Upgrade npm from 6.10.1 to 6.14.4 aminatakonate000/Graviton-App#3

Open

okdana mentioned this issue Jun 17, 2020

[BUG] Install via Git fails when running with sudo (no access to SSH_AUTH_SOCK) #44

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BUG] Some git commands are executed under destination directory's owner account #14

[BUG] Some git commands are executed under destination directory's owner account #14

x-yuri commented Oct 31, 2019 •

edited

Loading

isaacs commented Dec 4, 2019

x-yuri commented Feb 24, 2020

isaacs commented Feb 26, 2020

x-yuri commented Feb 26, 2020 •

edited

Loading

[BUG] Some git commands are executed under destination directory's owner account #14

[BUG] Some git commands are executed under destination directory's owner account #14

Comments

x-yuri commented Oct 31, 2019 • edited Loading

What / Why

When

Where

How

Current Behavior

Steps to Reproduce

Expected Behavior

Who

References

More info

Old steps to reproduce

isaacs commented Dec 4, 2019

x-yuri commented Feb 24, 2020

isaacs commented Feb 26, 2020

x-yuri commented Feb 26, 2020 • edited Loading

x-yuri commented Oct 31, 2019 •

edited

Loading

x-yuri commented Feb 26, 2020 •

edited

Loading