Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes bin overwrites #7755

Merged
merged 6 commits into from Dec 11, 2019
Merged

Fixes bin overwrites #7755

merged 6 commits into from Dec 11, 2019

Conversation

arcanis
Copy link
Member

@arcanis arcanis commented Dec 11, 2019

Summary

In some circumstances Yarn would allow overwriting files on the filesystem with symlinks at install-time. Despite postinstall scripts having the ability to do that anyway this behavior isn't intended as Yarn installs are reputed to control side effects (the cache and temporary folders being the only exception). Bins shouldn't be able to escape the package because of Yarn.

Test plan

Adding tests

@buildsize
Copy link

buildsize bot commented Dec 11, 2019

File name Previous Size New Size Change
yarn-[version].noarch.rpm 1.18 MB 1.18 MB 170 bytes (0%)
yarn-[version].js 4.86 MB 4.86 MB 1.41 KB (0%)
yarn-legacy-[version].js 5.05 MB 5.05 MB 1.47 KB (0%)
yarn-v[version].tar.gz 1.19 MB 1.19 MB 254 bytes (0%)
yarn_[version]all.deb 869.75 KB 869.64 KB -114 bytes (0%)

@arcanis arcanis merged commit 039bafd into master Dec 11, 2019
arcanis added a commit that referenced this pull request Dec 11, 2019
* Fixes potential file overwrite at install time

* Fixes the regexp

* Adds warnings

* Fixes overzealous removals

* Fixes test

* Adds tests
@valerybugakov
Copy link
Contributor

Hey @arcanis, we've bumped into a new warning about invalid bin field. Could you explain why using dot in a bin key is not suggested?

For example:

{
  "bin": {
    "build.cli": "./cli.js"
  }
}

@d-fischer
Copy link

This breaks my build as well. Some of my bins have dots in their names, including a few that I have no control over.

@TheRealChssAddct
Copy link

Hey @arcanis, this breaks some packages from building because bin key names contain colons. Why so restrictive on the bin key name validation?

@arcanis
Copy link
Member Author

arcanis commented Jan 10, 2020

The name check is slightly too restrictive, but I don't have bandwidth to fix that atm. Please open a PR and link it here.

@valerybugakov
Copy link
Contributor

@arcanis done

VincentBailly pushed a commit to VincentBailly/yarn that referenced this pull request Jun 10, 2020
* Fixes potential file overwrite at install time

* Fixes the regexp

* Adds warnings

* Fixes overzealous removals

* Fixes test

* Adds tests
VincentBailly pushed a commit to VincentBailly/yarn that referenced this pull request Jun 10, 2020
* Fixes potential file overwrite at install time

* Fixes the regexp

* Adds warnings

* Fixes overzealous removals

* Fixes test

* Adds tests
rivy added a commit to rivy/scoop-bucket that referenced this pull request Oct 31, 2020
- using 1.19.2 as primary version; 1.22.5 has "invalid 'bin'" issues
  - ref: yarnpkg/yarn#7755
  - ref: yarnpkg/yarn#7811
  - but... *still* a problem even after PR#7811
rivy added a commit to rivy/scoop-bucket that referenced this pull request Nov 8, 2020
- using 1.19.2 as primary version; 1.22.5 has "invalid 'bin'" issues
  - ref: yarnpkg/yarn#7755
  - ref: yarnpkg/yarn#7811
  - but... *still* a problem even after PR#7811
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants