Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	node_credentials.cc	Lines:	201	232	86.6 %
Date:	2022-05-23 04:15:47	Branches:	96	170	56.5 %


#include "env-inl.h"
#include "node_external_reference.h"
#include "node_internals.h"
#include "util-inl.h"

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
#include <grp.h>  // getgrnam()
#include <pwd.h>  // getpwnam()
#endif            // NODE_IMPLEMENTS_POSIX_CREDENTIALS

#if !defined(_MSC_VER)
#include <unistd.h>  // setuid, getuid
#endif
#ifdef __linux__
#include <linux/capability.h>
#include <sys/syscall.h>
#endif  // __linux__

namespace node {

using v8::Array;
using v8::Context;
using v8::FunctionCallbackInfo;
using v8::HandleScope;
using v8::Isolate;
using v8::Local;
using v8::MaybeLocal;
using v8::Object;
using v8::String;
using v8::TryCatch;
using v8::Uint32;
using v8::Value;

namespace per_process {
bool linux_at_secure = false;
}  // namespace per_process

namespace credentials {

#if defined(__linux__)
// Returns true if the current process only has the passed-in capability.
bool HasOnly(int capability) {
  DCHECK(cap_valid(capability));

  struct __user_cap_data_struct cap_data[2];
  struct __user_cap_header_struct cap_header_data = {
    _LINUX_CAPABILITY_VERSION_3,
    getpid()};


  if (syscall(SYS_capget, &cap_header_data, &cap_data) != 0) {
    return false;
  }
  if (capability < 32) {
    return cap_data[0].permitted ==
        static_cast<unsigned int>(CAP_TO_MASK(capability));
  }
  return cap_data[1].permitted ==
      static_cast<unsigned int>(CAP_TO_MASK(capability));
}
#endif

// Look up the environment variable and allow the lookup if the current
// process only has the capability CAP_NET_BIND_SERVICE set. If the current
// process does not have any capabilities set and the process is running as
// setuid root then lookup will not be allowed.
bool SafeGetenv(const char* key, std::string* text, Environment* env) {
#if !defined(__CloudABI__) && !defined(_WIN32)
#if defined(__linux__)
  if ((!HasOnly(CAP_NET_BIND_SERVICE) && per_process::linux_at_secure) ||
      getuid() != geteuid() || getgid() != getegid())
#else
  if (per_process::linux_at_secure || getuid() != geteuid() ||
      getgid() != getegid())
#endif
    goto fail;
#endif

  if (env != nullptr) {
    HandleScope handle_scope(env->isolate());
    TryCatch ignore_errors(env->isolate());
    MaybeLocal<String> maybe_value = env->env_vars()->Get(
        env->isolate(),
        String::NewFromUtf8(env->isolate(), key).ToLocalChecked());
    Local<String> value;
    if (!maybe_value.ToLocal(&value)) goto fail;
    String::Utf8Value utf8_value(env->isolate(), value);
    if (*utf8_value == nullptr) goto fail;
    *text = std::string(*utf8_value, utf8_value.length());
    return true;
  }

  {
    Mutex::ScopedLock lock(per_process::env_var_mutex);

    size_t init_sz = 256;
    MaybeStackBuffer<char, 256> val;
    int ret = uv_os_getenv(key, *val, &init_sz);

    if (ret == UV_ENOBUFS) {
      // Buffer is not large enough, reallocate to the updated init_sz
      // and fetch env value again.
      val.AllocateSufficientStorage(init_sz);
      ret = uv_os_getenv(key, *val, &init_sz);
    }

    if (ret >= 0) {  // Env key value fetch success.
      *text = *val;
      return true;
    }
  }

fail:
  text->clear();
  return false;
}

static void SafeGetenv(const FunctionCallbackInfo<Value>& args) {
  CHECK(args[0]->IsString());
  Environment* env = Environment::GetCurrent(args);
  Isolate* isolate = env->isolate();
  Utf8Value strenvtag(isolate, args[0]);
  std::string text;
  if (!SafeGetenv(*strenvtag, &text, env)) return;
  Local<Value> result =
      ToV8Value(isolate->GetCurrentContext(), text).ToLocalChecked();
  args.GetReturnValue().Set(result);
}

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS

static const uid_t uid_not_found = static_cast<uid_t>(-1);
static const gid_t gid_not_found = static_cast<gid_t>(-1);

static uid_t uid_by_name(const char* name) {
  struct passwd pwd;
  struct passwd* pp;
  char buf[8192];

  errno = 0;
  pp = nullptr;

  if (getpwnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
    return pp->pw_uid;

  return uid_not_found;
}

static char* name_by_uid(uid_t uid) {
  struct passwd pwd;
  struct passwd* pp;
  char buf[8192];
  int rc;

  errno = 0;
  pp = nullptr;

  if ((rc = getpwuid_r(uid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
      pp != nullptr) {
    return strdup(pp->pw_name);
  }

  if (rc == 0) errno = ENOENT;

  return nullptr;
}

static gid_t gid_by_name(const char* name) {
  struct group pwd;
  struct group* pp;
  char buf[8192];

  errno = 0;
  pp = nullptr;

  if (getgrnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
    return pp->gr_gid;

  return gid_not_found;
}

#if 0  // For future use.
static const char* name_by_gid(gid_t gid) {
  struct group pwd;
  struct group* pp;
  char buf[8192];
  int rc;

  errno = 0;
  pp = nullptr;

  if ((rc = getgrgid_r(gid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
      pp != nullptr) {
    return strdup(pp->gr_name);
  }

  if (rc == 0)
    errno = ENOENT;

  return nullptr;
}
#endif

static uid_t uid_by_name(Isolate* isolate, Local<Value> value) {
  if (value->IsUint32()) {
    return static_cast<uid_t>(value.As<Uint32>()->Value());
  } else {
    Utf8Value name(isolate, value);
    return uid_by_name(*name);
  }
}

static gid_t gid_by_name(Isolate* isolate, Local<Value> value) {
  if (value->IsUint32()) {
    return static_cast<gid_t>(value.As<Uint32>()->Value());
  } else {
    Utf8Value name(isolate, value);
    return gid_by_name(*name);
  }
}

static void GetUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // uid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(getuid()));
}

static void GetGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // gid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(getgid()));
}

static void GetEUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // uid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(geteuid()));
}

static void GetEGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());
  // gid_t is an uint32_t on all supported platforms.
  args.GetReturnValue().Set(static_cast<uint32_t>(getegid()));
}

static void SetGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  gid_t gid = gid_by_name(env->isolate(), args[0]);

  if (gid == gid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (setgid(gid)) {
    env->ThrowErrnoException(errno, "setgid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void SetEGid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  gid_t gid = gid_by_name(env->isolate(), args[0]);

  if (gid == gid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (setegid(gid)) {
    env->ThrowErrnoException(errno, "setegid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void SetUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  uid_t uid = uid_by_name(env->isolate(), args[0]);

  if (uid == uid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (setuid(uid)) {
    env->ThrowErrnoException(errno, "setuid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void SetEUid(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->owns_process_state());

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsUint32() || args[0]->IsString());

  uid_t uid = uid_by_name(env->isolate(), args[0]);

  if (uid == uid_not_found) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    args.GetReturnValue().Set(1);
  } else if (seteuid(uid)) {
    env->ThrowErrnoException(errno, "seteuid");
  } else {
    args.GetReturnValue().Set(0);
  }
}

static void GetGroups(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);
  CHECK(env->has_run_bootstrapping_code());

  int ngroups = getgroups(0, nullptr);
  if (ngroups == -1) return env->ThrowErrnoException(errno, "getgroups");

  std::vector<gid_t> groups(ngroups);

  ngroups = getgroups(ngroups, groups.data());
  if (ngroups == -1)
    return env->ThrowErrnoException(errno, "getgroups");

  groups.resize(ngroups);
  gid_t egid = getegid();
  if (std::find(groups.begin(), groups.end(), egid) == groups.end())
    groups.push_back(egid);
  MaybeLocal<Value> array = ToV8Value(env->context(), groups);
  if (!array.IsEmpty())
    args.GetReturnValue().Set(array.ToLocalChecked());
}

static void SetGroups(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);

  CHECK_EQ(args.Length(), 1);
  CHECK(args[0]->IsArray());

  Local<Array> groups_list = args[0].As<Array>();
  size_t size = groups_list->Length();
  MaybeStackBuffer<gid_t, 64> groups(size);

  for (size_t i = 0; i < size; i++) {
    gid_t gid = gid_by_name(
        env->isolate(), groups_list->Get(env->context(), i).ToLocalChecked());

    if (gid == gid_not_found) {
      // Tells JS to throw ERR_INVALID_CREDENTIAL
      args.GetReturnValue().Set(static_cast<uint32_t>(i + 1));
      return;
    }

    groups[i] = gid;
  }

  int rc = setgroups(size, *groups);

  if (rc == -1) return env->ThrowErrnoException(errno, "setgroups");

  args.GetReturnValue().Set(0);
}

static void InitGroups(const FunctionCallbackInfo<Value>& args) {
  Environment* env = Environment::GetCurrent(args);

  CHECK_EQ(args.Length(), 2);
  CHECK(args[0]->IsUint32() || args[0]->IsString());
  CHECK(args[1]->IsUint32() || args[1]->IsString());

  Utf8Value arg0(env->isolate(), args[0]);
  gid_t extra_group;
  bool must_free;
  char* user;

  if (args[0]->IsUint32()) {
    user = name_by_uid(args[0].As<Uint32>()->Value());
    must_free = true;
  } else {
    user = *arg0;
    must_free = false;
  }

  if (user == nullptr) {
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    return args.GetReturnValue().Set(1);
  }

  extra_group = gid_by_name(env->isolate(), args[1]);

  if (extra_group == gid_not_found) {
    if (must_free) free(user);
    // Tells JS to throw ERR_INVALID_CREDENTIAL
    return args.GetReturnValue().Set(2);
  }

  int rc = initgroups(user, extra_group);

  if (must_free) free(user);

  if (rc) return env->ThrowErrnoException(errno, "initgroups");

  args.GetReturnValue().Set(0);
}

#endif  // NODE_IMPLEMENTS_POSIX_CREDENTIALS

void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
  registry->Register(SafeGetenv);

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
  registry->Register(GetUid);
  registry->Register(GetEUid);
  registry->Register(GetGid);
  registry->Register(GetEGid);
  registry->Register(GetGroups);

  registry->Register(InitGroups);
  registry->Register(SetEGid);
  registry->Register(SetEUid);
  registry->Register(SetGid);
  registry->Register(SetUid);
  registry->Register(SetGroups);
#endif  // NODE_IMPLEMENTS_POSIX_CREDENTIALS
}

static void Initialize(Local<Object> target,
                       Local<Value> unused,
                       Local<Context> context,
                       void* priv) {
  Environment* env = Environment::GetCurrent(context);
  Isolate* isolate = env->isolate();

  env->SetMethod(target, "safeGetenv", SafeGetenv);

#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
  READONLY_TRUE_PROPERTY(target, "implementsPosixCredentials");
  env->SetMethodNoSideEffect(target, "getuid", GetUid);
  env->SetMethodNoSideEffect(target, "geteuid", GetEUid);
  env->SetMethodNoSideEffect(target, "getgid", GetGid);
  env->SetMethodNoSideEffect(target, "getegid", GetEGid);
  env->SetMethodNoSideEffect(target, "getgroups", GetGroups);

  if (env->owns_process_state()) {
    env->SetMethod(target, "initgroups", InitGroups);
    env->SetMethod(target, "setegid", SetEGid);
    env->SetMethod(target, "seteuid", SetEUid);
    env->SetMethod(target, "setgid", SetGid);
    env->SetMethod(target, "setuid", SetUid);
    env->SetMethod(target, "setgroups", SetGroups);
  }
#endif  // NODE_IMPLEMENTS_POSIX_CREDENTIALS
}

}  // namespace credentials
}  // namespace node

NODE_MODULE_CONTEXT_AWARE_INTERNAL(credentials, node::credentials::Initialize)
NODE_MODULE_EXTERNAL_REFERENCE(credentials,
                               node::credentials::RegisterExternalReferences)


Generated by: GCOVR (Version 4.2)

Line	Branch	Exec	Source
1			#include "env-inl.h"
2			#include "node_external_reference.h"
3			#include "node_internals.h"
4			#include "util-inl.h"
5
6			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
7			#include <grp.h> // getgrnam()
8			#include <pwd.h> // getpwnam()
9			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
10
11			#if !defined(_MSC_VER)
12			#include <unistd.h> // setuid, getuid
13			#endif
14			#ifdef __linux__
15			#include <linux/capability.h>
16			#include <sys/syscall.h>
17			#endif // __linux__
18
19			namespace node {
20
21			using v8::Array;
22			using v8::Context;
23			using v8::FunctionCallbackInfo;
24			using v8::HandleScope;
25			using v8::Isolate;
26			using v8::Local;
27			using v8::MaybeLocal;
28			using v8::Object;
29			using v8::String;
30			using v8::TryCatch;
31			using v8::Uint32;
32			using v8::Value;
33
34			namespace per_process {
35			bool linux_at_secure = false;
36			} // namespace per_process
37
38			namespace credentials {
39
40			#if defined(__linux__)
41			// Returns true if the current process only has the passed-in capability.
42		65502	bool HasOnly(int capability) {
43			DCHECK(cap_valid(capability));
44
45			struct __user_cap_data_struct cap_data[2];
46		65502	struct __user_cap_header_struct cap_header_data = {
47			_LINUX_CAPABILITY_VERSION_3,
48		65502	getpid()};
49
50
51	✗✓	65502	if (syscall(SYS_capget, &cap_header_data, &cap_data) != 0) {
52			return false;
53			}
54	✓✗	65502	if (capability < 32) {
55		65502	return cap_data[0].permitted ==
56		65502	static_cast<unsigned int>(CAP_TO_MASK(capability));
57			}
58			return cap_data[1].permitted ==
59			static_cast<unsigned int>(CAP_TO_MASK(capability));
60			}
61			#endif
62
63			// Look up the environment variable and allow the lookup if the current
64			// process only has the capability CAP_NET_BIND_SERVICE set. If the current
65			// process does not have any capabilities set and the process is running as
66			// setuid root then lookup will not be allowed.
67		65502	bool SafeGetenv(const char* key, std::string* text, Environment* env) {
68			#if !defined(__CloudABI__) && !defined(_WIN32)
69			#if defined(__linux__)
70	✓✗✓✗	196506	if ((!HasOnly(CAP_NET_BIND_SERVICE) && per_process::linux_at_secure) \|\|
71	✓✗✗✓ ✗✓	196506	getuid() != geteuid() \|\| getgid() != getegid())
72			#else
73			if (per_process::linux_at_secure \|\| getuid() != geteuid() \|\|
74			getgid() != getegid())
75			#endif
76			goto fail;
77			#endif
78
79	✓✓	65502	if (env != nullptr) {
80		18395	HandleScope handle_scope(env->isolate());
81		18395	TryCatch ignore_errors(env->isolate());
82		36790	MaybeLocal<String> maybe_value = env->env_vars()->Get(
83			env->isolate(),
84		36790	String::NewFromUtf8(env->isolate(), key).ToLocalChecked());
85			Local<String> value;
86	✓✓	18395	if (!maybe_value.ToLocal(&value)) goto fail;
87		6139	String::Utf8Value utf8_value(env->isolate(), value);
88	✗✓	6139	if (*utf8_value == nullptr) goto fail;
89		6139	text = std::string(utf8_value, utf8_value.length());
90		6139	return true;
91			}
92
93			{
94		47107	Mutex::ScopedLock lock(per_process::env_var_mutex);
95
96		47107	size_t init_sz = 256;
97		47107	MaybeStackBuffer<char, 256> val;
98		47107	int ret = uv_os_getenv(key, *val, &init_sz);
99
100	✗✓	47107	if (ret == UV_ENOBUFS) {
101			// Buffer is not large enough, reallocate to the updated init_sz
102			// and fetch env value again.
103			val.AllocateSufficientStorage(init_sz);
104			ret = uv_os_getenv(key, *val, &init_sz);
105			}
106
107	✓✓	47107	if (ret >= 0) { // Env key value fetch success.
108		5204	text = val;
109		5204	return true;
110			}
111			}
112
113		54159	fail:
114		54159	text->clear();
115		54159	return false;
116			}
117
118	✓✗	12367	static void SafeGetenv(const FunctionCallbackInfo<Value>& args) {
119	✗✓	24734	CHECK(args[0]->IsString());
120		12367	Environment* env = Environment::GetCurrent(args);
121		12367	Isolate* isolate = env->isolate();
122		12367	Utf8Value strenvtag(isolate, args[0]);
123		12367	std::string text;
124	✓✓	12367	if (!SafeGetenv(*strenvtag, &text, env)) return;
125			Local<Value> result =
126		12166	ToV8Value(isolate->GetCurrentContext(), text).ToLocalChecked();
127		12166	args.GetReturnValue().Set(result);
128			}
129
130			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
131
132			static const uid_t uid_not_found = static_cast<uid_t>(-1);
133			static const gid_t gid_not_found = static_cast<gid_t>(-1);
134
135		4	static uid_t uid_by_name(const char* name) {
136			struct passwd pwd;
137			struct passwd* pp;
138			char buf[8192];
139
140		4	errno = 0;
141		4	pp = nullptr;
142
143	✓✗✓✓ ✓✓	4	if (getpwnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
144		2	return pp->pw_uid;
145
146		2	return uid_not_found;
147			}
148
149			static char* name_by_uid(uid_t uid) {
150			struct passwd pwd;
151			struct passwd* pp;
152			char buf[8192];
153			int rc;
154
155			errno = 0;
156			pp = nullptr;
157
158			if ((rc = getpwuid_r(uid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
159			pp != nullptr) {
160			return strdup(pp->pw_name);
161			}
162
163			if (rc == 0) errno = ENOENT;
164
165			return nullptr;
166			}
167
168		4	static gid_t gid_by_name(const char* name) {
169			struct group pwd;
170			struct group* pp;
171			char buf[8192];
172
173		4	errno = 0;
174		4	pp = nullptr;
175
176	✓✗✗✓ ✗✓	4	if (getgrnam_r(name, &pwd, buf, sizeof(buf), &pp) == 0 && pp != nullptr)
177			return pp->gr_gid;
178
179		4	return gid_not_found;
180			}
181
182			#if 0 // For future use.
183			static const char* name_by_gid(gid_t gid) {
184			struct group pwd;
185			struct group* pp;
186			char buf[8192];
187			int rc;
188
189			errno = 0;
190			pp = nullptr;
191
192			if ((rc = getgrgid_r(gid, &pwd, buf, sizeof(buf), &pp)) == 0 &&
193			pp != nullptr) {
194			return strdup(pp->gr_name);
195			}
196
197			if (rc == 0)
198			errno = ENOENT;
199
200			return nullptr;
201			}
202			#endif
203
204		6	static uid_t uid_by_name(Isolate* isolate, Local<Value> value) {
205	✓✓	6	if (value->IsUint32()) {
206		2	return static_cast<uid_t>(value.As<Uint32>()->Value());
207			} else {
208		8	Utf8Value name(isolate, value);
209		4	return uid_by_name(*name);
210			}
211			}
212
213		7	static gid_t gid_by_name(Isolate* isolate, Local<Value> value) {
214	✓✓	7	if (value->IsUint32()) {
215		3	return static_cast<gid_t>(value.As<Uint32>()->Value());
216			} else {
217		8	Utf8Value name(isolate, value);
218		4	return gid_by_name(*name);
219			}
220			}
221
222		249	static void GetUid(const FunctionCallbackInfo<Value>& args) {
223		249	Environment* env = Environment::GetCurrent(args);
224	✗✓	249	CHECK(env->has_run_bootstrapping_code());
225			// uid_t is an uint32_t on all supported platforms.
226		249	args.GetReturnValue().Set(static_cast<uint32_t>(getuid()));
227		249	}
228
229		111	static void GetGid(const FunctionCallbackInfo<Value>& args) {
230		111	Environment* env = Environment::GetCurrent(args);
231	✗✓	111	CHECK(env->has_run_bootstrapping_code());
232			// gid_t is an uint32_t on all supported platforms.
233		111	args.GetReturnValue().Set(static_cast<uint32_t>(getgid()));
234		111	}
235
236		2	static void GetEUid(const FunctionCallbackInfo<Value>& args) {
237		2	Environment* env = Environment::GetCurrent(args);
238	✗✓	2	CHECK(env->has_run_bootstrapping_code());
239			// uid_t is an uint32_t on all supported platforms.
240		2	args.GetReturnValue().Set(static_cast<uint32_t>(geteuid()));
241		2	}
242
243		2	static void GetEGid(const FunctionCallbackInfo<Value>& args) {
244		2	Environment* env = Environment::GetCurrent(args);
245	✗✓	2	CHECK(env->has_run_bootstrapping_code());
246			// gid_t is an uint32_t on all supported platforms.
247		2	args.GetReturnValue().Set(static_cast<uint32_t>(getegid()));
248		2	}
249
250		2	static void SetGid(const FunctionCallbackInfo<Value>& args) {
251		2	Environment* env = Environment::GetCurrent(args);
252	✗✓	2	CHECK(env->owns_process_state());
253
254	✗✓	2	CHECK_EQ(args.Length(), 1);
255	✓✓✗✓ ✗✓	4	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
256
257		2	gid_t gid = gid_by_name(env->isolate(), args[0]);
258
259	✓✓	2	if (gid == gid_not_found) {
260			// Tells JS to throw ERR_INVALID_CREDENTIAL
261		2	args.GetReturnValue().Set(1);
262	✓✗	1	} else if (setgid(gid)) {
263		1	env->ThrowErrnoException(errno, "setgid");
264			} else {
265			args.GetReturnValue().Set(0);
266			}
267		2	}
268
269		2	static void SetEGid(const FunctionCallbackInfo<Value>& args) {
270		2	Environment* env = Environment::GetCurrent(args);
271	✗✓	2	CHECK(env->owns_process_state());
272
273	✗✓	2	CHECK_EQ(args.Length(), 1);
274	✓✓✗✓ ✗✓	4	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
275
276		2	gid_t gid = gid_by_name(env->isolate(), args[0]);
277
278	✓✓	2	if (gid == gid_not_found) {
279			// Tells JS to throw ERR_INVALID_CREDENTIAL
280		2	args.GetReturnValue().Set(1);
281	✓✗	1	} else if (setegid(gid)) {
282		1	env->ThrowErrnoException(errno, "setegid");
283			} else {
284			args.GetReturnValue().Set(0);
285			}
286		2	}
287
288		3	static void SetUid(const FunctionCallbackInfo<Value>& args) {
289		3	Environment* env = Environment::GetCurrent(args);
290	✗✓	3	CHECK(env->owns_process_state());
291
292	✗✓	3	CHECK_EQ(args.Length(), 1);
293	✓✓✗✓ ✗✓	7	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
294
295		3	uid_t uid = uid_by_name(env->isolate(), args[0]);
296
297	✓✓	3	if (uid == uid_not_found) {
298			// Tells JS to throw ERR_INVALID_CREDENTIAL
299		2	args.GetReturnValue().Set(1);
300	✓✗	2	} else if (setuid(uid)) {
301		2	env->ThrowErrnoException(errno, "setuid");
302			} else {
303			args.GetReturnValue().Set(0);
304			}
305		3	}
306
307		3	static void SetEUid(const FunctionCallbackInfo<Value>& args) {
308		3	Environment* env = Environment::GetCurrent(args);
309	✗✓	3	CHECK(env->owns_process_state());
310
311	✗✓	3	CHECK_EQ(args.Length(), 1);
312	✓✓✗✓ ✗✓	7	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
313
314		3	uid_t uid = uid_by_name(env->isolate(), args[0]);
315
316	✓✓	3	if (uid == uid_not_found) {
317			// Tells JS to throw ERR_INVALID_CREDENTIAL
318		2	args.GetReturnValue().Set(1);
319	✓✗	2	} else if (seteuid(uid)) {
320		2	env->ThrowErrnoException(errno, "seteuid");
321			} else {
322			args.GetReturnValue().Set(0);
323			}
324		3	}
325
326		2	static void GetGroups(const FunctionCallbackInfo<Value>& args) {
327		2	Environment* env = Environment::GetCurrent(args);
328	✗✓	2	CHECK(env->has_run_bootstrapping_code());
329
330		2	int ngroups = getgroups(0, nullptr);
331	✗✓	2	if (ngroups == -1) return env->ThrowErrnoException(errno, "getgroups");
332
333		2	std::vector<gid_t> groups(ngroups);
334
335		2	ngroups = getgroups(ngroups, groups.data());
336	✗✓	2	if (ngroups == -1)
337			return env->ThrowErrnoException(errno, "getgroups");
338
339		2	groups.resize(ngroups);
340		2	gid_t egid = getegid();
341	✗✓	2	if (std::find(groups.begin(), groups.end(), egid) == groups.end())
342			groups.push_back(egid);
343		2	MaybeLocal<Value> array = ToV8Value(env->context(), groups);
344	✓✗	2	if (!array.IsEmpty())
345	✗✓	4	args.GetReturnValue().Set(array.ToLocalChecked());
346			}
347
348		1	static void SetGroups(const FunctionCallbackInfo<Value>& args) {
349		1	Environment* env = Environment::GetCurrent(args);
350
351	✗✓	1	CHECK_EQ(args.Length(), 1);
352	✗✓	1	CHECK(args[0]->IsArray());
353
354		2	Local<Array> groups_list = args[0].As<Array>();
355		1	size_t size = groups_list->Length();
356		1	MaybeStackBuffer<gid_t, 64> groups(size);
357
358	✓✗	2	for (size_t i = 0; i < size; i++) {
359		2	gid_t gid = gid_by_name(
360		2	env->isolate(), groups_list->Get(env->context(), i).ToLocalChecked());
361
362	✓✓	2	if (gid == gid_not_found) {
363			// Tells JS to throw ERR_INVALID_CREDENTIAL
364	✓✗	1	args.GetReturnValue().Set(static_cast<uint32_t>(i + 1));
365		1	return;
366			}
367
368		1	groups[i] = gid;
369			}
370
371			int rc = setgroups(size, *groups);
372
373			if (rc == -1) return env->ThrowErrnoException(errno, "setgroups");
374
375			args.GetReturnValue().Set(0);
376			}
377
378		1	static void InitGroups(const FunctionCallbackInfo<Value>& args) {
379		1	Environment* env = Environment::GetCurrent(args);
380
381	✗✓	1	CHECK_EQ(args.Length(), 2);
382	✓✗✗✓ ✗✓	3	CHECK(args[0]->IsUint32() \|\| args[0]->IsString());
383	✓✗✗✓ ✗✓	3	CHECK(args[1]->IsUint32() \|\| args[1]->IsString());
384
385		1	Utf8Value arg0(env->isolate(), args[0]);
386			gid_t extra_group;
387			bool must_free;
388			char* user;
389
390	✗✓	1	if (args[0]->IsUint32()) {
391			user = name_by_uid(args[0].As<Uint32>()->Value());
392			must_free = true;
393			} else {
394		1	user = *arg0;
395		1	must_free = false;
396			}
397
398	✗✓	1	if (user == nullptr) {
399			// Tells JS to throw ERR_INVALID_CREDENTIAL
400			return args.GetReturnValue().Set(1);
401			}
402
403		1	extra_group = gid_by_name(env->isolate(), args[1]);
404
405	✓✗	1	if (extra_group == gid_not_found) {
406	✗✓	1	if (must_free) free(user);
407			// Tells JS to throw ERR_INVALID_CREDENTIAL
408		2	return args.GetReturnValue().Set(2);
409			}
410
411			int rc = initgroups(user, extra_group);
412
413			if (must_free) free(user);
414
415			if (rc) return env->ThrowErrnoException(errno, "initgroups");
416
417			args.GetReturnValue().Set(0);
418			}
419
420			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
421
422		5187	void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
423		5187	registry->Register(SafeGetenv);
424
425			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
426		5187	registry->Register(GetUid);
427		5187	registry->Register(GetEUid);
428		5187	registry->Register(GetGid);
429		5187	registry->Register(GetEGid);
430		5187	registry->Register(GetGroups);
431
432		5187	registry->Register(InitGroups);
433		5187	registry->Register(SetEGid);
434		5187	registry->Register(SetEUid);
435		5187	registry->Register(SetGid);
436		5187	registry->Register(SetUid);
437		5187	registry->Register(SetGroups);
438			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
439		5187	}
440
441		847	static void Initialize(Local<Object> target,
442			Local<Value> unused,
443			Local<Context> context,
444			void* priv) {
445		847	Environment* env = Environment::GetCurrent(context);
446		847	Isolate* isolate = env->isolate();
447
448		847	env->SetMethod(target, "safeGetenv", SafeGetenv);
449
450			#ifdef NODE_IMPLEMENTS_POSIX_CREDENTIALS
451		2541	READONLY_TRUE_PROPERTY(target, "implementsPosixCredentials");
452		847	env->SetMethodNoSideEffect(target, "getuid", GetUid);
453		847	env->SetMethodNoSideEffect(target, "geteuid", GetEUid);
454		847	env->SetMethodNoSideEffect(target, "getgid", GetGid);
455		847	env->SetMethodNoSideEffect(target, "getegid", GetEGid);
456		847	env->SetMethodNoSideEffect(target, "getgroups", GetGroups);
457
458	✓✓	847	if (env->owns_process_state()) {
459		53	env->SetMethod(target, "initgroups", InitGroups);
460		53	env->SetMethod(target, "setegid", SetEGid);
461		53	env->SetMethod(target, "seteuid", SetEUid);
462		53	env->SetMethod(target, "setgid", SetGid);
463		53	env->SetMethod(target, "setuid", SetUid);
464		53	env->SetMethod(target, "setgroups", SetGroups);
465			}
466			#endif // NODE_IMPLEMENTS_POSIX_CREDENTIALS
467		847	}
468
469			} // namespace credentials
470			} // namespace node
471
472		5255	NODE_MODULE_CONTEXT_AWARE_INTERNAL(credentials, node::credentials::Initialize)
473		5187	NODE_MODULE_EXTERNAL_REFERENCE(credentials,
474			node::credentials::RegisterExternalReferences)