Stop following symlinks when archiving directories

src/archiveDirectory.ts

@@ -83,8 +83,8 @@
   // `tar` returns a `TypeError` if `allFiles` is empty. Let's check a feww things.
   try {
     fs.statSync(sourceDirectory);
   } catch (err: any) {
     if (err.code === "ENOENT") {
       throw new FirebaseError(`Could not read directory "${sourceDirectory}"`);
     }
     throw err;
@@ -100,7 +100,7 @@
       gzip: true,
       file: tempFile.name,
       cwd: sourceDirectory,
-      follow: true,
+      follow: false,
       noDirRecurse: true,
       portable: true,
     },
@@ -135,13 +135,21 @@
   let files: fsAsync.ReaddirRecursiveFile[];
   try {
     files = await fsAsync.readdirRecursive({ path: sourceDirectory, ignore: options.ignore });
   } catch (err: any) {
     if (err.code === "ENOENT") {
       throw new FirebaseError(`Could not read directory "${sourceDirectory}"`, { original: err });
     }
     throw err;
   }
-  for (const file of files) {
+  // For security, filter out all symlinks. This code is a bit obtuse to preserve ordering.
+  const realFiles = (await Promise.all(
+    files.map(async (f) => {
+      const stats = await fs.promises.lstat(f.name);
+      return stats.isSymbolicLink() ? null : f;
+    }),
+  )).filter((fileOrNull): fileOrNull is typeof files[number] => fileOrNull !== null);
+
+  for (const file of realFiles) {
     const name = path.relative(sourceDirectory, file.name);
     allFiles.push(name);
     archive.file(file.name, {