Clean tar save file path (#1236)

ije · web-flow · commit 9d77b88c3207 · 2025-11-18T07:26:47.000+08:00
diff --git a/server/npmrc.go b/server/npmrc.go
@@ -546,7 +546,7 @@ func extractPackageTarball(installDir string, pkgName string, tarball io.Reader)
 		}
 		// strip tarball root dir
 		_, name := utils.SplitByFirstByte(h.Name, '/')
-		filename := path.Join(pkgDir, name)
+		filename := path.Join(pkgDir, path.Clean(name))
 		if h.Typeflag != tar.TypeReg {
 			continue
 		}

Original file line number	Diff line number	Diff line change
`@@ -546,7 +546,7 @@ func extractPackageTarball(installDir string, pkgName string, tarball io.Reader)`
`546`	`546`	`}`
`547`	`547`	`// strip tarball root dir`
`548`	`548`	`_, name := utils.SplitByFirstByte(h.Name, '/')`
`549`		`- filename := path.Join(pkgDir, name)`
	`549`	`+ filename := path.Join(pkgDir, path.Clean(name))`
`550`	`550`	`if h.Typeflag != tar.TypeReg {`
`551`	`551`	`continue`
`552`	`552`	`}`