link: fail if package link target is the same as package link source

Thomas Hallock · iarna · commit 0d4a0b173203 · 2016-03-24T17:11:19.000-07:00
Credit: @antialias Reviewed-By: @iarna PR-URL: #11442
diff --git a/lib/utils/link.js b/lib/utils/link.js
@@ -25,6 +25,24 @@ function linkIfExists (from, to, gently, cb) {
   })
 }
 
+function resolveIfSymlink (maybeSymlinkPath, cb) {
+  fs.lstat(maybeSymlinkPath, function (err, stat) {
+    if (err) return cb.apply(this, arguments)
+    if (!stat.isSymbolicLink()) return cb(null, maybeSymlinkPath)
+    fs.readlink(maybeSymlinkPath, cb)
+  })
+}
+
+function ensureFromIsNotSource (from, to, cb) {
+  resolveIfSymlink(from, function (err, fromDestination) {
+    if (err) return cb.apply(this, arguments)
+    if (path.resolve(path.dirname(from), fromDestination) === path.resolve(to)) {
+      return cb(new Error('Link target resolves to the same directory as link source: ' + to))
+    }
+    cb.apply(this, arguments)
+  })
+}
+
 function link (from, to, gently, abs, cb) {
   if (typeof cb !== 'function') {
     cb = abs
@@ -48,6 +66,7 @@ function link (from, to, gently, abs, cb) {
 
   chain(
     [
+      [ensureFromIsNotSource, from, to],
       [fs, 'stat', from],
       [rm, to, gently],
       [mkdir, path.dirname(to)],
diff --git a/test/tap/link.js b/test/tap/link.js
@@ -3,13 +3,15 @@ var osenv = require('osenv')
 var path = require('path')
 var rimraf = require('rimraf')
 var test = require('tap').test
+var lstatSync = require('fs').lstatSync
 var writeFileSync = require('fs').writeFileSync
 
 var common = require('../common-tap.js')
 
 var link = path.join(__dirname, 'link')
 var linkScoped = path.join(__dirname, 'link-scoped')
 var linkInstall = path.join(__dirname, 'link-install')
+var linkInside = path.join(linkInstall, 'node_modules', 'inside')
 var linkRoot = path.join(__dirname, 'link-root')
 
 var config = 'prefix = ' + linkRoot
@@ -57,6 +59,18 @@ var installJSON = {
   license: 'ISC'
 }
 
+var insideInstallJSON = {
+  name: 'inside',
+  version: '1.0.0',
+  description: '',
+  main: 'index.js',
+  scripts: {
+    test: 'echo \"Error: no test specified\" && exit 1'
+  },
+  author: '',
+  license: 'ISC'
+}
+
 test('setup', function (t) {
   setup()
   common.npm(['ls', '-g', '--depth=0'], OPTS, function (err, c, out) {
@@ -81,6 +95,20 @@ test('create global link', function (t) {
   })
 })
 
+test('create global inside link', function (t) {
+  process.chdir(linkInside)
+  common.npm(['link'], OPTS, function (err, c, out) {
+    t.ifError(err, 'link has no error')
+    common.npm(['ls', '-g'], OPTS, function (err, c, out, stderr) {
+      t.ifError(err)
+      t.equal(c, 0)
+      t.equal(stderr, '', 'got expected stderr')
+      t.has(out, /inside@1.0.0/, 'creates global inside link ok')
+      t.end()
+    })
+  })
+})
+
 test('create scoped global link', function (t) {
   process.chdir(linkScoped)
   common.npm(['link'], OPTS, function (err, c, out) {
@@ -108,6 +136,17 @@ test('link-install the package', function (t) {
   })
 })
 
+test('link-inside-install fails', function (t) {
+  process.chdir(linkInstall)
+  t.notOk(lstatSync(linkInside).isSymbolicLink(), 'directory for linked package is not a symlink to begin with')
+  common.npm(['link', 'inside'], OPTS, function (err, code) {
+    t.ifError(err, 'npm removed the linked package without error')
+    t.notEqual(code, 0, 'link operation failed')
+    t.notOk(lstatSync(linkInside).isSymbolicLink(), 'directory for linked package has not turned into a symlink')
+    t.end()
+  })
+})
+
 test('link-install the scoped package', function (t) {
   process.chdir(linkInstall)
   common.npm(['link', linkScoped], OPTS, function (err) {
@@ -141,6 +180,7 @@ function cleanup () {
   rimraf.sync(link)
   rimraf.sync(linkScoped)
   rimraf.sync(linkInstall)
+  rimraf.sync(linkInside)
 }
 
 function setup () {
@@ -161,5 +201,10 @@ function setup () {
     path.join(linkInstall, 'package.json'),
     JSON.stringify(installJSON, null, 2)
   )
+  mkdirp.sync(linkInside)
+  writeFileSync(
+    path.join(linkInside, 'package.json'),
+    JSON.stringify(insideInstallJSON, null, 2)
+  )
   writeFileSync(configPath, config)
 }
