fix(dev): reject a cloudflared version that escapes the release url or cache

Author: danielroe

packages/nuxt-cli/src/dev/binaries.ts

@@ -44,7 +44,12 @@ async function locateTool(name: string, options: { url?: string, archive?: boole
 returnexisting
 }
 constcacheName=options.cacheName||name
-constdestination=join(getCacheDir('bin'),process.platform==='win32' ? `${cacheName}.exe` : cacheName)
+constcacheDir=getCacheDir('bin')
+constdestination=join(cacheDir,process.platform==='win32' ? `${cacheName}.exe` : cacheName)
+if(dirname(destination)!==cacheDir){
+debug(`Refusing to cache \`${name}\` outside ${cacheDir}.`)
+returnundefined
+}
 if(existsSync(destination)){
 returndestination
 }

packages/nuxt-cli/src/dev/tunnel.ts

@@ -9,11 +9,27 @@ import { resolveTool } from './binaries'
 
 constTUNNEL_URL_RE=/https:\/\/(?!api\.)[\w-]+\.trycloudflare\.com/
 
+constDEFAULT_CLOUDFLARED_VERSION='2026.7.3'
+constCLOUDFLARED_VERSION_RE=/^[\w.-]+$/
+
 /**
- * Pinned so a bad Cloudflare release cannot break `--tunnel` for everyone.
- * Set `CLOUDFLARED_VERSION` (or `latest`) to override.
+ * Version of `cloudflared` to download. Pinned so a bad Cloudflare release
+ * cannot break `--tunnel` for everyone; `CLOUDFLARED_VERSION` (or `latest`)
+ * overrides it.
+ *
+ * The value reaches both a release URL and a cache filename, so anything that
+ * is not a bare version is rejected rather than allowed to traverse either.
  */
-constCLOUDFLARED_VERSION=process.env.CLOUDFLARED_VERSION||'2026.7.3'
+exportfunctionresolveCloudflaredVersion(version=process.env.CLOUDFLARED_VERSION): string{
+if(!version){
+returnDEFAULT_CLOUDFLARED_VERSION
+}
+if(!CLOUDFLARED_VERSION_RE.test(version)){
+logger.warn(`Ignoring invalid \`CLOUDFLARED_VERSION\` value \`${version}\`.`)
+returnDEFAULT_CLOUDFLARED_VERSION
+}
+returnversion
+}
 
 /** How long to wait for `cloudflared` to exit on `SIGINT` before `SIGKILL`. */
 constSHUTDOWN_TIMEOUT_MS=5000
@@ -146,6 +162,7 @@ const CLOUDFLARED_ASSETS: Record<string, Partial<Record<typeof process.arch, str
 }
 
 asyncfunctionresolveCloudflared(): Promise<string|undefined>{
+constCLOUDFLARED_VERSION=resolveCloudflaredVersion()
 constbase=CLOUDFLARED_VERSION==='latest'
  ? 'https://github.com/cloudflare/cloudflared/releases/latest/download'
  : `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}`

packages/nuxt-cli/test/unit/dev/binaries.spec.ts

@@ -0,0 +1,67 @@
+import{mkdtempSync,rmSync}from'node:fs'
+import{tmpdir}from'node:os'
+importprocessfrom'node:process'
+
+import{join}from'pathe'
+import{afterEach,beforeEach,describe,expect,it,vi}from'vitest'
+
+import{getCacheDir,resolveTool}from'../../../src/dev/binaries'
+import{resolveCloudflaredVersion}from'../../../src/dev/tunnel'
+
+letcacheHome: string
+constoriginalCacheHome=process.env.XDG_CACHE_HOME
+
+beforeEach(()=>{
+cacheHome=mkdtempSync(join(tmpdir(),'nuxt-binaries-'))
+process.env.XDG_CACHE_HOME=cacheHome
+})
+
+afterEach(()=>{
+vi.restoreAllMocks()
+rmSync(cacheHome,{recursive: true,force: true})
+if(originalCacheHome===undefined){
+deleteprocess.env.XDG_CACHE_HOME
+}
+else{
+process.env.XDG_CACHE_HOME=originalCacheHome
+}
+})
+
+describe('resolveCloudflaredVersion',()=>{
+it('should fall back to the pinned version when the override is unset',()=>{
+expect(resolveCloudflaredVersion(undefined)).toMatch(/^\d/)
+expect(resolveCloudflaredVersion('')).toBe(resolveCloudflaredVersion(undefined))
+})
+
+it('should accept a plain version or dist tag',()=>{
+expect(resolveCloudflaredVersion('2026.7.3')).toBe('2026.7.3')
+expect(resolveCloudflaredVersion('latest')).toBe('latest')
+})
+
+it('should reject a version that could traverse the release url or the cache',()=>{
+constpinned=resolveCloudflaredVersion(undefined)
+expect(resolveCloudflaredVersion('../../../../tmp/evil')).toBe(pinned)
+expect(resolveCloudflaredVersion('2026.7.3/../..')).toBe(pinned)
+expect(resolveCloudflaredVersion('a b')).toBe(pinned)
+})
+})
+
+describe('resolveTool',()=>{
+it('should refuse a cache name that escapes the cache directory',async()=>{
+constfetchSpy=vi.spyOn(globalThis,'fetch')
+
+awaitexpect(resolveTool('nuxt-tool-that-does-not-exist',{
+url: 'https://example.com/cloudflared',
+cacheName: '../../escaped',
+consent: {key: 'nuxt-tool-that-does-not-exist',notice: [],message: '',nonInteractiveWarning: ''},
+})).resolves.toBeUndefined()
+
+expect(fetchSpy).not.toHaveBeenCalled()
+})
+})
+
+describe('getCacheDir',()=>{
+it('should create the directory under XDG_CACHE_HOME',()=>{
+expect(getCacheDir('bin')).toBe(join(cacheHome,'nuxt','bin'))
+})
+})