Hagana self-authorize break out

[Mickael-van-der-Beek]

Since Hagana is available to the other node_modules, it's possible to call Hagana inside the malicious module to self-authorise the wanted actions.

e.g: the malicious library code:

import fs from 'fs';
import path from 'path';
import hagana from '@hagana/hagana';

export function run () {
  const fileDirectory = path.resolve(path.dirname('.'), '..');
  const filePath = path.resolve(fileDirectory, './out.txt');
  hagana.setRoot(fileDirectory);
  fs.writeFileSync(filePath, 'yolooo', { encoding: 'utf-8' });
}

[yaakov123]

🤦🏻‍♂️ This is a good find. I guess the only way to solve this is by maintaining internal state to know that hagana has already been required and then prevent additional requires.

Need to think about this.

[Mickael-van-der-Beek]

I would probably block any calls to Hagana coming from the library directory outside of Hagana's directory itself.

[yaakov123]

That's a better idea.