fix(vite): bind vite-node IPC to a permissioned filesystem socket

danielroe · danielroe · commit c293bf9503cc · 2026-06-02T14:03:55.000+01:00
(cherry picked from commit d2ea350bd359cc8f07e1d0b968c136b9e9a5cf48) Refs: GHSA-534h-c3cw-v3h9
diff --git a/packages/vite/src/plugins/vite-node.ts b/packages/vite/src/plugins/vite-node.ts
@@ -1,12 +1,12 @@
 import process from 'node:process'
-import { unlink } from 'node:fs/promises'
+import { rm } from 'node:fs/promises'
 import type { Socket } from 'node:net'
 import net from 'node:net'
 import os from 'node:os'
 import fs from 'node:fs' // For sync operations like unlinkSync if needed during setup
 import { pathToFileURL } from 'node:url'
 import { Buffer } from 'node:buffer'
-import { isAbsolute, join, normalize } from 'pathe'
+import { dirname, isAbsolute, join, normalize } from 'pathe'
 import { directoryToURL, resolveAlias, tryUseNuxt, useNitro } from '@nuxt/kit'
 import type { EnvironmentModuleNode, ModuleNode, PluginContainer, ViteDevServer, Plugin as VitePlugin } from 'vite'
 import { getQuery } from 'ufo'
@@ -15,7 +15,6 @@ import { ViteNodeServer } from 'vite-node/server'
 import { normalizeViteManifest } from 'vue-bundle-renderer'
 import type { Manifest } from 'vue-bundle-renderer'
 import type { Nuxt } from '@nuxt/schema'
-import { provider } from 'std-env'
 import { resolveModulePath } from 'exsolve'
 
 import { isCSS } from '../utils/index.ts'
@@ -125,34 +124,28 @@ function getManifest (nuxt: Nuxt, viteServer: ViteDevServer, clientEntry: string
   return manifest
 }
 
-function generateSocketPath () {
+export interface SocketPathInfo {
+  socketPath: string
+  /** mkdtemp directory we own; cleaned up on close. Undefined for Windows pipes. */
+  parentDir?: string
+}
+
+// only exported for tests
+export function pickSocketPath (platform: NodeJS.Platform): SocketPathInfo {
   const uniqueSuffix = `${process.pid}-${Date.now()}`
   const socketName = `nuxt-vite-node-${uniqueSuffix}`
 
-  // Windows: pipe
-  if (process.platform === 'win32') {
-    return join(String.raw`\\.\pipe`, socketName)
+  if (platform === 'win32') {
+    return { socketPath: join(String.raw`\\.\pipe`, socketName) }
   }
-  // Linux: abstract namespace
-  if (process.platform === 'linux') {
-    const nodeMajor = Number.parseInt(process.versions.node.split('.')[0]!, 10)
-    if (nodeMajor >= 20 && provider !== 'stackblitz') {
-      // We avoid abstract sockets in Docker due to performance issues
-      let isDocker = false
-
-      try {
-        isDocker = fs.existsSync('/.dockerenv') || (fs.existsSync('/proc/1/cgroup') && fs.readFileSync('/proc/1/cgroup', 'utf8').includes('docker'))
-      } catch {
-        // Ignore errors checking Docker status
-      }
+  // place the socket inside a freshly-created 0700 directory to gate access.
+  const parentDir = fs.mkdtempSync(join(os.tmpdir(), 'nuxt-vite-node-'))
+  fs.chmodSync(parentDir, 0o700)
+  return { socketPath: join(parentDir, `${socketName}.sock`), parentDir }
+}
 
-      if (!isDocker) {
-        return `\0${socketName}.sock`
-      }
-    }
-  }
-  // Unix socket
-  return join(os.tmpdir(), `${socketName}.sock`)
+function generateSocketPath (): SocketPathInfo {
+  return pickSocketPath(process.platform)
 }
 
 function useInvalidates () {
@@ -186,18 +179,21 @@ export function ViteNodePlugin (nuxt: Nuxt): VitePlugin | undefined {
   }
 
   let socketServer: net.Server | undefined
-  const socketPath = generateSocketPath()
+  const { socketPath, parentDir } = generateSocketPath()
   const { invalidates, markInvalidate, markInvalidates } = useInvalidates()
 
+  let cleanedUp = false
   async function cleanupSocket () {
+    if (cleanedUp) { return }
+    cleanedUp = true
     if (socketServer && socketServer.listening) {
       await new Promise<void>(resolveClose => socketServer!.close(() => resolveClose()))
     }
-    if (socketPath && !socketPath.startsWith('\\\\.\\pipe\\')) {
+    if (parentDir) {
       try {
-        await unlink(socketPath)
+        await rm(parentDir, { recursive: true, force: true })
       } catch {
-        // Error is ignored if the file doesn't exist or cannot be unlinked
+        // mkdtemp directory cleanup is best-effort
       }
     }
   }
@@ -473,26 +469,45 @@ function createViteNodeSocketServer (nuxt: Nuxt, ssrServer: ViteDevServer, clien
     throw new Error('Socket path not configured for ViteNodeSocketServer.')
   }
 
-  // Clean up existing socket file (Unix only)
-  if (!currentSocketPath.startsWith('\\\\.\\pipe\\')) {
-    try {
-      fs.unlinkSync(currentSocketPath)
-    } catch (unlinkError: any) {
-      if (unlinkError.code !== 'ENOENT') {
-        // Socket cleanup failed, but continue anyway
-      }
-    }
-  }
+  listenAndRestrict(server, currentSocketPath)
 
-  server.listen(currentSocketPath)
-
-  server.on('error', () => {
-    // Server error - will be handled by calling code
-  })
+  server.on('error', () => {})
 
   return server
 }
 
+export function listenAndRestrict (server: net.Server, socketPath: string): void {
+  const isWindowsPipe = socketPath.startsWith('\\\\.\\pipe\\')
+  if (isWindowsPipe) {
+    server.listen(socketPath)
+    return
+  }
+  // 1. the 0700 parent directory (created by pickSocketPath) is the access-control
+  //    boundary, since AF_UNIX connect requires +x on every parent.
+  // 2. The post-listen chmod 0600 protects the socket file itself.
+  // 3. The umask wrap tightens the in-process window between bind(2) and the chmod,
+  //    where the file would otherwise briefly exist with the default umask
+  //    and be observable to other code.
+  const previousUmask = process.umask(0o077)
+  try {
+    server.listen(socketPath, () => {
+      try {
+        fs.chmodSync(socketPath, 0o600)
+      } catch (error) {
+        console.error('[nuxt] Failed to restrict vite-node socket permissions; closing.', error)
+        server.close()
+        try {
+          fs.rmSync(dirname(socketPath), { recursive: true, force: true })
+        } catch {
+          // mkdtemp directory cleanup is best-effort
+        }
+      }
+    })
+  } finally {
+    process.umask(previousUmask)
+  }
+}
+
 function sendResponse<T extends keyof ViteNodeRequestMap> (
   socket: net.Socket,
   id: number,
diff --git a/packages/vite/test/vite-node.test.ts b/packages/vite/test/vite-node.test.ts
@@ -0,0 +1,81 @@
+import fs from 'node:fs'
+import net from 'node:net'
+import os from 'node:os'
+import process from 'node:process'
+import { afterEach, describe, expect, it } from 'vitest'
+import { listenAndRestrict, pickSocketPath } from '../src/plugins/vite-node.ts'
+
+const createdDirs: string[] = []
+
+function trackedPick (platform: NodeJS.Platform = process.platform) {
+  const info = pickSocketPath(platform)
+  if (info.parentDir) {
+    createdDirs.push(info.parentDir)
+  }
+  return info
+}
+
+afterEach(() => {
+  while (createdDirs.length) {
+    const dir = createdDirs.pop()!
+    fs.rmSync(dir, { recursive: true, force: true })
+  }
+})
+
+const realTmpdir = fs.realpathSync(os.tmpdir())
+
+describe('pickSocketPath', () => {
+  it('uses a filesystem socket on Linux, not an abstract namespace socket', () => {
+    const { socketPath, parentDir } = trackedPick('linux')
+    expect(socketPath.startsWith('\0')).toBe(false)
+    expect(parentDir).toBeDefined()
+    expect(fs.realpathSync(parentDir!).startsWith(realTmpdir)).toBe(true)
+  })
+
+  it('uses a filesystem socket on macOS', () => {
+    const { socketPath, parentDir } = trackedPick('darwin')
+    expect(socketPath.startsWith('\0')).toBe(false)
+    expect(parentDir).toBeDefined()
+    expect(fs.realpathSync(parentDir!).startsWith(realTmpdir)).toBe(true)
+  })
+
+  it('uses a named pipe on Windows', () => {
+    const { socketPath, parentDir } = pickSocketPath('win32')
+    expect(socketPath.startsWith('\0')).toBe(false)
+    expect(socketPath).toContain('/pipe/')
+    expect(parentDir).toBeUndefined()
+  })
+
+  it('places the socket in a 0700 parent directory on Unix', { skip: process.platform === 'win32' }, () => {
+    const { parentDir } = trackedPick()
+    const stat = fs.statSync(parentDir!)
+    expect(stat.mode & 0o777).toBe(0o700)
+  })
+})
+
+describe('listenAndRestrict', () => {
+  it.runIf(process.platform !== 'win32')('binds a socket with mode 0600', async () => {
+    const { socketPath } = trackedPick()
+    const server = net.createServer()
+    await new Promise<void>((resolve, reject) => {
+      server.once('listening', () => resolve())
+      server.once('error', reject)
+      listenAndRestrict(server, socketPath)
+    })
+    try {
+      const stat = fs.statSync(socketPath)
+      expect(stat.mode & 0o777).toBe(0o600)
+    } finally {
+      await new Promise<void>(resolve => server.close(() => resolve()))
+    }
+  })
+
+  it.runIf(process.platform !== 'win32')('binds with no group/other permission bits before the listening callback fires', () => {
+    const { socketPath } = trackedPick()
+    const server = net.createServer()
+    listenAndRestrict(server, socketPath)
+    const stat = fs.statSync(socketPath)
+    expect(stat.mode & 0o077).toBe(0)
+    server.close()
+  })
+})
