fix: restrict sync-chapters input path

scripts/sync-chapters.js

@@ -28,6 +28,42 @@ const REGION = {
 // must not mass-delete chapter pages.
 const MIN_LIVE_CHAPTERS = 15;
 
+// The sync-chapters workflow always hands us a file inside /tmp
+// (see .github/workflows/sync-chapters.yml). Treat that as the only
+// approved input location and refuse to read anything outside it.
+const INPUT_DIR = "/tmp";
+
+// Resolve the caller-provided input path against the approved input directory
+// and refuse anything that escapes it. path.resolve + a .json suffix check are
+// not enough on their own: they still permit absolute paths, ../ traversal, and
+// symlinks that point elsewhere. We canonicalize with fs.realpathSync so a
+// symlinked file cannot smuggle us outside the boundary, then verify
+// containment with path.relative before the file is ever read.
+function resolveInputPath(src, inputDir = INPUT_DIR) {
+  // realpath the boundary too: on macOS /tmp is itself a symlink to
+  // /private/tmp, so both sides must be canonicalized to compare.
+  const baseReal = fs.realpathSync(inputDir);
+  const candidate = path.resolve(baseReal, src);
+
+  // Canonicalize the target if it exists so a symlinked file that points
+  // outside the boundary is caught; fall back to the lexical path otherwise.
+  let resolved;
+  try {
+    resolved = fs.realpathSync(candidate);
+  } catch {
+    resolved = candidate;
+  }
+
+  const rel = path.relative(baseReal, resolved);
+  if (rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel)) {
+    throw new Error(`input file must be inside ${inputDir}`);
+  }
+  if (!resolved.endsWith(".json")) {
+    throw new Error("input file must have a .json extension");
+  }
+  return resolved;
+}
+
 function yamlStr(value) {
   const needsQuote =
     value.includes(": ") ||
@@ -75,7 +111,15 @@ function main() {
     process.exit(1);
   }
 
-  const data = JSON.parse(fs.readFileSync(src, "utf8"));
+  let resolvedSrc;
+  try {
+    resolvedSrc = resolveInputPath(src);
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+
+  const data = JSON.parse(fs.readFileSync(resolvedSrc, "utf8"));
   const live = data.chapters.filter((c) => c.leaders && c.leaders.length > 0);
   if (live.length < MIN_LIVE_CHAPTERS) {
     console.error(
@@ -107,4 +151,8 @@ function main() {
   console.log(`synced ${wrote} chapters, removed ${removed}`);
 }
 
-main();
+if (require.main === module) {
+  main();
+}
+
+module.exports = { resolveInputPath, render, yamlStr };

tests/sync-chapters.test.js

@@ -0,0 +1,87 @@
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const { resolveInputPath } = require("../scripts/sync-chapters");
+
+// Each case builds a throwaway input directory so we exercise the containment
+// boundary without touching the real /tmp. resolveInputPath takes the boundary
+// as an argument for exactly this reason.
+function withScratchDir(fn) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sync-chapters-"));
+  // Canonicalize so assertions compare against the same path realpath returns
+  // (macOS resolves the tmp symlink to /private/...).
+  const realDir = fs.realpathSync(dir);
+  try {
+    fn(realDir);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test("resolveInputPath accepts a .json file inside the input directory", () => {
+  withScratchDir((dir) => {
+    fs.writeFileSync(path.join(dir, "chapters.json"), "{}");
+    const resolved = resolveInputPath("chapters.json", dir);
+    assert.equal(resolved, path.join(dir, "chapters.json"));
+  });
+});
+
+test("resolveInputPath accepts an absolute path inside the input directory", () => {
+  withScratchDir((dir) => {
+    const abs = path.join(dir, "chapters.json");
+    fs.writeFileSync(abs, "{}");
+    assert.equal(resolveInputPath(abs, dir), abs);
+  });
+});
+
+test("resolveInputPath rejects ../ traversal out of the input directory", () => {
+  withScratchDir((dir) => {
+    assert.throws(() => resolveInputPath("../escape.json", dir), /inside/);
+  });
+});
+
+test("resolveInputPath rejects an absolute path outside the input directory", () => {
+  withScratchDir((dir) => {
+    assert.throws(() => resolveInputPath("/etc/passwd.json", dir), /inside/);
+  });
+});
+
+test("resolveInputPath rejects a lexical escape that climbs above the directory", () => {
+  withScratchDir((dir) => {
+    assert.throws(
+      () => resolveInputPath("subdir/../../escape.json", dir),
+      /inside/,
+    );
+  });
+});
+
+test("resolveInputPath rejects a symlink inside the dir pointing outside", () => {
+  withScratchDir((dir) => {
+    const outside = fs.mkdtempSync(path.join(os.tmpdir(), "sync-outside-"));
+    const target = path.join(outside, "secret.json");
+    fs.writeFileSync(target, "{}");
+    const link = path.join(dir, "link.json");
+    try {
+      fs.symlinkSync(target, link);
+    } catch {
+      // Some environments disallow symlink creation; nothing to assert there.
+      fs.rmSync(outside, { recursive: true, force: true });
+      return;
+    }
+    try {
+      assert.throws(() => resolveInputPath("link.json", dir), /inside/);
+    } finally {
+      fs.rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});
+
+test("resolveInputPath rejects a non-.json file inside the directory", () => {
+  withScratchDir((dir) => {
+    fs.writeFileSync(path.join(dir, "chapters.txt"), "{}");
+    assert.throws(() => resolveInputPath("chapters.txt", dir), /\.json/);
+  });
+});