@@ -1,8 +1,10 @@
11import path from "node:path";
22import {
3+assertNoSymlinkParents,
34assertNoSymlinkParentsSync,
45readRegularFile,
56readRegularFileSync,
7+statRegularFile,
68statRegularFileSync,
79} from "openclaw/plugin-sdk/security-runtime";
810@@ -14,22 +16,30 @@ export function resolveWebCredsBackupPath(authDir: string): string {
1416return path.join(authDir, "creds.json.bak");
1517}
161817-function assertWebCredsParentPathSafe(filePath: string): void {
19+function resolveWebCredsParentCheck(filePath: string) {
1820const dir = path.resolve(path.dirname(filePath));
19-assertNoSymlinkParentsSync({
21+return {
2022rootDir: path.parse(dir).root,
2123targetPath: dir,
2224allowMissing: true,
2325allowRootChildSymlink: true,
2426requireDirectories: true,
2527messagePrefix: "WhatsApp credential file path",
26-});
28+} as const;
2729}
283029-export function assertWebCredsPathRegularFileOrMissing(filePath: string): void {
31+async function assertWebCredsParentPathSafe(filePath: string): Promise<void> {
32+await assertNoSymlinkParents(resolveWebCredsParentCheck(filePath));
33+}
34+35+function assertWebCredsParentPathSafeSync(filePath: string): void {
36+assertNoSymlinkParentsSync(resolveWebCredsParentCheck(filePath));
37+}
38+39+export async function assertWebCredsPathRegularFileOrMissing(filePath: string): Promise<void> {
3040try {
31-assertWebCredsParentPathSafe(filePath);
32-statRegularFileSync(filePath);
41+await assertWebCredsParentPathSafe(filePath);
42+await statRegularFile(filePath);
3343} catch (error) {
3444throw new Error(
3545`WhatsApp credential file path is unsafe; creds.json must be a regular file or missing: ${filePath}`,
@@ -38,18 +48,9 @@ export function assertWebCredsPathRegularFileOrMissing(filePath: string): void {
3848}
3949}
405041-export function isWebCredsPathRegularFileOrMissing(filePath: string): boolean {
42-try {
43-assertWebCredsPathRegularFileOrMissing(filePath);
44-return true;
45-} catch {
46-return false;
47-}
48-}
49-5051export function readWebCredsJsonRawSync(filePath: string): string | null {
5152try {
52-assertWebCredsParentPathSafe(filePath);
53+assertWebCredsParentPathSafeSync(filePath);
5354const { buffer, stat } = readRegularFileSync({
5455 filePath,
5556});
@@ -61,7 +62,7 @@ export function readWebCredsJsonRawSync(filePath: string): string | null {
61626263export async function readWebCredsJsonRaw(filePath: string): Promise<string | null> {
6364try {
64-assertWebCredsParentPathSafe(filePath);
65+await assertWebCredsParentPathSafe(filePath);
6566const { buffer, stat } = await readRegularFile({
6667 filePath,
6768});
@@ -73,7 +74,7 @@ export async function readWebCredsJsonRaw(filePath: string): Promise<string | nu
73747475export function statWebCredsFileSync(filePath: string): { mtimeMs: number; size: number } | null {
7576try {
76-assertWebCredsParentPathSafe(filePath);
77+assertWebCredsParentPathSafeSync(filePath);
7778const result = statRegularFileSync(filePath);
7879if (result.missing || result.stat.size <= 1) {
7980return null;
@@ -90,7 +91,7 @@ export function statWebCredsFileSync(filePath: string): { mtimeMs: number; size:
9091export function hasWebCredsRegularFileSync(authDir: string): boolean {
9192try {
9293const credsPath = resolveWebCredsPath(authDir);
93-assertWebCredsParentPathSafe(credsPath);
94+assertWebCredsParentPathSafeSync(credsPath);
9495return !statRegularFileSync(credsPath).missing;
9596} catch {
9697return false;
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。